From b3ce5cce92b7fa7c64d91675efc3de8fe0044643 Mon Sep 17 00:00:00 2001 From: v-sabiraj Date: Tue, 7 Apr 2026 17:15:26 +0530 Subject: [PATCH 1/2] Replace Azure Security Benchmark label and queries Update workbook JSON to replace occurrences of "Azure Security Benchmark" with "Microsoft cloud security benchmark" across user-facing text, headings, and KQL queries (including ComplianceStandard checks and noDataMessage strings). This aligns displayed labels and query filters with the updated complianceStandard identifier so recommendations, filters, and remediation links surface correctly. --- .../Workbooks/AzureSecurityBenchmark.json | 216 +++++++++--------- 1 file changed, 108 insertions(+), 108 deletions(-) diff --git a/Solutions/AzureSecurityBenchmark/Workbooks/AzureSecurityBenchmark.json b/Solutions/AzureSecurityBenchmark/Workbooks/AzureSecurityBenchmark.json index 740e8d1274d..40becc8e0de 100644 --- a/Solutions/AzureSecurityBenchmark/Workbooks/AzureSecurityBenchmark.json +++ b/Solutions/AzureSecurityBenchmark/Workbooks/AzureSecurityBenchmark.json @@ -124,7 +124,7 @@ { "type": 1, "content": { - "json": "## Getting Started\r\nThis solution leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align directly with the Azure Security Benchmark. A filter set in guide, subscription, workspace, time, and ASB control are available for customized reporting and review. The documentation below provides getting started recommendations for centralizing log analytics data and enabling Microsoft Defender for Cloud Continuous Export. This offering includes integration with Microsoft 1st Party, Partner 3rd Party ecosystem, hybrid, on-premises, and multi-cloud workloads. Common use cases include conducting ASB assessments which custom reporting, time filtering, subscription filtering, workspace filtering, and guides. The report is exportable for print or PDF with the Print Workbook feature. The solution is organized by ASB control areas, each area has multiple control cards. Control cards include ASB logging over time, current ASB assessment recommendations, ASB status, documentation guides, recommendations, and links to product pages, documentation, and portals for all referenced products.
\r\n\r\n### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions)\r\n| Roles | Rights | \r\n|:--|:--|\r\n|Security Reader | View solutions, Analytics, Security Recommendations |\r\n|Security Contributor| Deploy/Modify solutions, Analytics, Apply Security Recommendations |\r\n|Owner| Assign Regulatory Compliance Initiatives|\r\n\r\n### Onboarding Prerequisites \r\n1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
\r\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\r\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\r\n4️⃣ [Add the Azure Security Benchmark Assessment to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\r\n5️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n6️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\r\n7️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
\r\n8️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
\r\n\r\n### Print/Export Report\r\n1️⃣ Set Background Theme: Settings > Appearance > Theme: Azure > Apply
\r\n2️⃣ Print/Export Report: More Content Actions (...) > Print Content
\r\n3️⃣ Settings: Layout (Landscape), Pages (All), Print (One Sided), Scale (60), Pages Per Sheet (1), Quality (1,200 DPI), Margins (None) > Print
\r\n4️⃣ Executive Summary: Microsoft Defender for Cloud > Regulatory Compliance > Download Report > Report Standard (Azure Security Benchmark), Format (PDF)\r\n\r\n### Important\r\nThis solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All requirements, validations, and controls are governed by respective organizations. This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. ", + "json": "## Getting Started\r\nThis solution leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align directly with the Microsoft cloud security benchmark. A filter set in guide, subscription, workspace, time, and ASB control are available for customized reporting and review. The documentation below provides getting started recommendations for centralizing log analytics data and enabling Microsoft Defender for Cloud Continuous Export. This offering includes integration with Microsoft 1st Party, Partner 3rd Party ecosystem, hybrid, on-premises, and multi-cloud workloads. Common use cases include conducting ASB assessments which custom reporting, time filtering, subscription filtering, workspace filtering, and guides. The report is exportable for print or PDF with the Print Workbook feature. The solution is organized by ASB control areas, each area has multiple control cards. Control cards include ASB logging over time, current ASB assessment recommendations, ASB status, documentation guides, recommendations, and links to product pages, documentation, and portals for all referenced products.
\r\n\r\n### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions)\r\n| Roles | Rights | \r\n|:--|:--|\r\n|Security Reader | View solutions, Analytics, Security Recommendations |\r\n|Security Contributor| Deploy/Modify solutions, Analytics, Apply Security Recommendations |\r\n|Owner| Assign Regulatory Compliance Initiatives|\r\n\r\n### Onboarding Prerequisites \r\n1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
\r\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\r\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\r\n4️⃣ [Add the Microsoft cloud security benchmark Assessment to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\r\n5️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n6️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\r\n7️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
\r\n8️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
\r\n\r\n### Print/Export Report\r\n1️⃣ Set Background Theme: Settings > Appearance > Theme: Azure > Apply
\r\n2️⃣ Print/Export Report: More Content Actions (...) > Print Content
\r\n3️⃣ Settings: Layout (Landscape), Pages (All), Print (One Sided), Scale (60), Pages Per Sheet (1), Quality (1,200 DPI), Margins (None) > Print
\r\n4️⃣ Executive Summary: Microsoft Defender for Cloud > Regulatory Compliance > Download Report > Report Standard (Microsoft cloud security benchmark), Format (PDF)\r\n\r\n### Important\r\nThis solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All requirements, validations, and controls are governed by respective organizations. This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. ", "style": "info" }, "conditionalVisibility": { @@ -137,7 +137,7 @@ { "type": 1, "content": { - "json": "# [Azure Security Benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\n---\n\nThe Azure Security Benchmark v3 Solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Azure Security Benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. " + "json": "# [Microsoft cloud security benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\n---\n\nThe Microsoft cloud security benchmark v3 Solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Microsoft cloud security benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. " }, "customWidth": "79", "name": "Workbook Overview" @@ -679,7 +679,7 @@ { "type": 1, "content": { - "json": "# [Posture Assessment](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\r\n---\r\nThe Posture Assessment section provides a mechanism to find, fix, and resolve Azure Security Benchmark recommendations. A selector provides capability to filter by all, specific, or groups of control families. Upon selection, subordinate panels will summarize recommendations by control family, status over time, recommendations, and resources identified with deep-link for remediation." + "json": "# [Posture Assessment](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\r\n---\r\nThe Posture Assessment section provides a mechanism to find, fix, and resolve Microsoft cloud security benchmark recommendations. A selector provides capability to filter by all, specific, or groups of control families. Upon selection, subordinate panels will summarize recommendations by control family, status over time, recommendations, and resources identified with deep-link for remediation." }, "customWidth": "40", "name": "NS Guide" @@ -710,7 +710,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityRegulatoryCompliance\r\n| where ComplianceStandard == \"Azure-Security-Benchmark\"\r\n| extend ComplianceDomain=iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| summarize count() by ComplianceDomain\r\n| sort by count_ desc\r\n| project-away count_\r\n", + "query": "SecurityRegulatoryCompliance\r\n| where ComplianceStandard == \"Microsoft-cloud-security-benchmark\"\r\n| extend ComplianceDomain=iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| summarize count() by ComplianceDomain\r\n| sort by count_ desc\r\n| project-away count_\r\n", "crossComponentResources": [ "{Workspace}" ], @@ -743,11 +743,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink) on RecommendationName\r\n| extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain}) \r\n | distinct RecommendationName, ComplianceDomain, tostring(RecommendationLink), tostring(state), tostring(complianceState)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or complianceState == \"Failed\") by ComplianceDomain\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n | project ControlFamily=ComplianceDomain, Total, PassedControls, Passed, Failed\r\n | sort by Total, Passed desc", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink) on RecommendationName\r\n| extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain has (ComplianceDomain) \r\n | distinct RecommendationName, ComplianceDomain, tostring(RecommendationLink), tostring(state), tostring(complianceState)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\" or complianceState == \"Failed\") by ComplianceDomain\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n | project ControlFamily=ComplianceDomain, Total, PassedControls, Passed, Failed\r\n | sort by Total, Passed desc", "size": 0, "showAnalytics": true, "title": "Recommendations by Control Area", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -830,11 +830,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName\r\n| extend ComplianceDomain=iff(ControlID contains \"AM.\", \"Asset Management\", iff(ControlID contains \"BR.\", \"Backup & Recovery\", iff(ControlID contains \"DP.\", \"Data Protection\", iff(ControlID contains \"DS.\", \"DevOps Security\", iff(ControlID contains \"ES.\", \"Endpoint Security\", iff(ControlID contains \"GS.\", \"Governance & Strategy\", iff(ControlID contains \"IM.\", \"Identity Management\", iff(ControlID contains \"IR.\", \"Incident Response\", iff(ControlID contains \"LT.\", \"Logging & Threat Detection\", iff(ControlID contains \"NS.\", \"Network Security\", iff(ControlID contains \"PA.\", \"Privileged Access\", iff(ControlID contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain}) \r\n| extend Remediate=RecommendationLink\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName\r\n| extend ComplianceDomain=iff(ControlID contains \"AM.\", \"Asset Management\", iff(ControlID contains \"BR.\", \"Backup & Recovery\", iff(ControlID contains \"DP.\", \"Data Protection\", iff(ControlID contains \"DS.\", \"DevOps Security\", iff(ControlID contains \"ES.\", \"Endpoint Security\", iff(ControlID contains \"GS.\", \"Governance & Strategy\", iff(ControlID contains \"IM.\", \"Identity Management\", iff(ControlID contains \"IR.\", \"Incident Response\", iff(ControlID contains \"LT.\", \"Logging & Threat Detection\", iff(ControlID contains \"NS.\", \"Network Security\", iff(ControlID contains \"PA.\", \"Privileged Access\", iff(ControlID contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain has (ComplianceDomain) \r\n| extend Remediate=RecommendationLink\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -922,11 +922,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain}) \r\n| distinct RecommendationName, resourceId, tostring(state), tostring(complianceState)\r\n| summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\") by resourceId\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| where Failed > 0\r\n| project AssessedResourceId=resourceId, Total, PassedControls, Passed, Failed\r\n| sort by Total, Passed desc\r\n| limit 250\r\n", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain has (ComplianceDomain) \r\n| distinct RecommendationName, resourceId, tostring(state), tostring(complianceState)\r\n| summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\") by resourceId\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| where Failed > 0\r\n| project AssessedResourceId=resourceId, Total, PassedControls, Passed, Failed\r\n| sort by Total, Passed desc\r\n| limit 250\r\n", "size": 0, "showAnalytics": true, "title": "Recommendations by Asset", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -1019,7 +1019,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityRegulatoryCompliance\r\n| where ComplianceStandard == \"Azure-Security-Benchmark\"\r\n| extend ComplianceDomain=iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain})\r\n| where State == \"Failed\"\r\n| make-series count() default=0 on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step 1d by ComplianceDomain\r\n| render timechart ", + "query": "SecurityRegulatoryCompliance\r\n| where ComplianceStandard == \"Microsoft-cloud-security-benchmark\"\r\n| extend ComplianceDomain=iff(ComplianceControl contains \"AM.\", \"Asset Management\", iff(ComplianceControl contains \"BR.\", \"Backup & Recovery\", iff(ComplianceControl contains \"DP.\", \"Data Protection\", iff(ComplianceControl contains \"DS.\", \"DevOps Security\", iff(ComplianceControl contains \"ES.\", \"Endpoint Security\", iff(ComplianceControl contains \"GS.\", \"Governance & Strategy\", iff(ComplianceControl contains \"IM.\", \"Identity Management\", iff(ComplianceControl contains \"IR.\", \"Incident Response\", iff(ComplianceControl contains \"LT.\", \"Logging & Threat Detection\", iff(ComplianceControl contains \"NS.\", \"Network Security\", iff(ComplianceControl contains \"PA.\", \"Privileged Access\", iff(ComplianceControl contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain})\r\n| where State == \"Failed\"\r\n| make-series count() default=0 on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step 1d by ComplianceDomain\r\n| render timechart ", "size": 0, "showAnalytics": true, "title": "Recommendations over Time", @@ -1105,7 +1105,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain in ({ComplianceDomain}) \r\n| where state == \"Unhealthy\"\r\n| extend FirstObserved = properties1.status.statusChangeDate\r\n| parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| project ResourceID=resourceId, RecommendationName, ControlFamily=ComplianceDomain, ControlID=controlId, Severity=severity, CurrentState=state, Remediate=RecommendationLink, FirstObserved, assessmentKey\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend ComplianceDomain=iff(controlId contains \"AM.\", \"Asset Management\", iff(controlId contains \"BR.\", \"Backup & Recovery\", iff(controlId contains \"DP.\", \"Data Protection\", iff(controlId contains \"DS.\", \"DevOps Security\", iff(controlId contains \"ES.\", \"Endpoint Security\", iff(controlId contains \"GS.\", \"Governance & Strategy\", iff(controlId contains \"IM.\", \"Identity Management\", iff(controlId contains \"IR.\", \"Incident Response\", iff(controlId contains \"LT.\", \"Logging & Threat Detection\", iff(controlId contains \"NS.\", \"Network Security\", iff(controlId contains \"PA.\", \"Privileged Access\", iff(controlId contains \"PV.\", \"Posture & Vulnerability Management\",\"Other\"))))))))))))\r\n| where ComplianceDomain has (ComplianceDomain) \r\n| where state == \"Unhealthy\"\r\n| extend FirstObserved = properties1.status.statusChangeDate\r\n| parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| project ResourceID=resourceId, RecommendationName, ControlFamily=ComplianceDomain, ControlID=controlId, Severity=severity, CurrentState=state, Remediate=RecommendationLink, FirstObserved, assessmentKey\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "showAnalytics": true, "title": "Current Recommendation Details", @@ -1263,7 +1263,7 @@ { "type": 1, "content": { - "json": "# [Controls Crosswalk](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\r\n---\r\nControls crosswalk provides a mapping of Azure Security Benchmark v3 controls across additional compliance frameworks. This provides free-text search capabilities mapping numerous frameworks including CIS v8, NIST SP 800-53 R4, and PCI-DSS v3. There is also a mapping for recommended Microsoft products for each of these control requirements. " + "json": "# [Controls Crosswalk](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\r\n---\r\nControls crosswalk provides a mapping of Microsoft cloud security benchmark v3 controls across additional compliance frameworks. This provides free-text search capabilities mapping numerous frameworks including CIS v8, NIST SP 800-53 R4, and PCI-DSS v3. There is also a mapping for recommended Microsoft products for each of these control requirements. " }, "customWidth": "40", "name": "Controls Mapping" @@ -1842,11 +1842,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2150,11 +2150,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2392,11 +2392,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -2976,11 +2976,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3332,11 +3332,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3694,11 +3694,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -3909,11 +3909,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.8\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.8\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -4436,11 +4436,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.10\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"NS.10\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -5183,11 +5183,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -5776,11 +5776,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -6211,11 +6211,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| where RecommendationName contains \"TLS\" or RecommendationName contains \"Auth\" or RecommendationName contains \"JIT\" or RecommendationName contains \"access\"\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| where RecommendationName contains \"TLS\" or RecommendationName contains \"Auth\" or RecommendationName contains \"JIT\" or RecommendationName contains \"access\"\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -6623,11 +6623,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IM.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -8006,11 +8006,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -8334,11 +8334,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -8752,11 +8752,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -9403,11 +9403,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PA.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -10732,11 +10732,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -11053,11 +11053,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -11268,11 +11268,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -11483,11 +11483,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -11698,11 +11698,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -11933,11 +11933,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.7\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -12254,11 +12254,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.8\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DP.8\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -13211,11 +13211,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"AM.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"AM.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -13851,11 +13851,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"AM.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"AM.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -14407,11 +14407,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -14944,11 +14944,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -15327,11 +15327,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -15965,11 +15965,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -16518,11 +16518,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"LT.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -17443,11 +17443,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IR.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IR.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -17718,11 +17718,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IR.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"IR.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -19742,11 +19742,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -20184,11 +20184,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.4\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -20399,11 +20399,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.5\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -20946,11 +20946,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"PV.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -21461,11 +21461,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where RecommendationName contains \"endpoint protection\" or RecommendationName contains \"virus\" or RecommendationName contains \"defender for servers\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where RecommendationName contains \"endpoint protection\" or RecommendationName contains \"virus\" or RecommendationName contains \"defender for servers\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -21782,11 +21782,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"ES.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"ES.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -22103,11 +22103,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"ES.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"ES.3\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -22701,11 +22701,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"BR.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"BR.1\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -23002,11 +23002,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"BR.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"BR.2\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -24095,11 +24095,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where RecommendationName contains \"contain\" or RecommendationName contains \"aks\" or RecommendationName contains \"kube\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where RecommendationName contains \"contain\" or RecommendationName contains \"aks\" or RecommendationName contains \"kube\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -24885,7 +24885,7 @@ { "type": 1, "content": { - "json": "# [Enforce Security of Workload throughout DevOps Lifecycle (DS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-6-enforce-security-of-workload-throughout-devops-lifecycle)\r\n\r\nEnsure the workload is secured throughout the entire lifecycle in development, testing, and deployment stage. Use Azure Security Benchmark to evaluate the controls (such as network security, identity management, privileged access and so on) that can be set as guardrails by default or shift left prior to the deployment stage. \r\n\r\n## Recommended Logs\r\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n## Implementation\r\n💡 [Shared Image Gallery overview](https://docs.microsoft.com/azure/virtual-machines/windows/shared-image-galleries)
\r\n💡 [How to implement Azure Defender for Cloud vulnerability assessment recommendations](https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations)
\r\n💡 [Security considerations for Azure Container](https://docs.microsoft.com/azure/container-instances/container-instances-image-security)
\r\n💡 [Azure Defender for container registries](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-introduction)
\r\n\r\n## Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
" + "json": "# [Enforce Security of Workload throughout DevOps Lifecycle (DS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-6-enforce-security-of-workload-throughout-devops-lifecycle)\r\n\r\nEnsure the workload is secured throughout the entire lifecycle in development, testing, and deployment stage. Use Microsoft cloud security benchmark to evaluate the controls (such as network security, identity management, privileged access and so on) that can be set as guardrails by default or shift left prior to the deployment stage. \r\n\r\n## Recommended Logs\r\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n## Implementation\r\n💡 [Shared Image Gallery overview](https://docs.microsoft.com/azure/virtual-machines/windows/shared-image-galleries)
\r\n💡 [How to implement Azure Defender for Cloud vulnerability assessment recommendations](https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations)
\r\n💡 [Security considerations for Azure Container](https://docs.microsoft.com/azure/container-instances/container-instances-image-security)
\r\n💡 [Azure Defender for container registries](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-introduction)
\r\n\r\n## Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
" }, "conditionalVisibility": { "parameterName": "isDSVisible", @@ -24965,11 +24965,11 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Azure Security Benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DS.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", + "query": "securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | join kind = leftouter(\r\n securityresources\r\n | where type == \"microsoft.security/assessments\") on subscriptionId, name\r\n | extend complianceState = properties.state\r\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\r\n | extend recommendationId = id1\r\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\r\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\r\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\r\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\r\n | extend regexResourceId = extract_all(@\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\", resourceId)[0]\r\n | extend resourceType = iff(regexResourceId[1] != \"\", regexResourceId[1], iff(regexResourceId[0] != \"\", regexResourceId[0], \"subscriptions\"))\r\n | extend resourceName = regexResourceId[2]\r\n | extend recommendationName = name\r\n | extend RecommendationName = properties1.displayName\r\n | extend description = properties1.metadata.description\r\n | extend remediationSteps = properties1.metadata.remediationDescription\r\n | extend severity = properties1.metadata.severity\r\n | extend state = properties1.status.code\r\n | extend notApplicableReason = properties1.status.cause\r\n | extend RecommendationLink = properties1.links.azurePortal\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | extend complianceControlId = extract(@\"/regulatoryComplianceControls/([^/]*)\", 1, id)\r\n | join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend controlName = tostring(properties.description)\r\n | project controlId = name, controlName\r\n | distinct *) on $right.controlId == $left.complianceControlId\r\n | extend RecommendationName = tostring(properties.description)\r\n | summarize Failed = countif(state == \"Unhealthy\"), Passed = countif(state == \"Healthy\" or complianceState == \"Passed\"), Total = countif(state == \"Unhealthy\" or state == \"Healthy\" or complianceState == \"Passed\") by RecommendationName, ControlID = controlId\r\n | extend PassedControls = (Passed/todouble(Total))*100\r\n| join kind = leftouter (securityresources\r\n | where type == \"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\"\r\n | extend complianceStandardId = replace( \"-\", \" \", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\r\n | where complianceStandardId == \"Microsoft cloud security benchmark\"\r\n | extend RecommendationName = tostring(properties.description)\r\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\r\n | project RecommendationName, RecommendationLink, name) on RecommendationName \r\n| extend Remediate=RecommendationLink\r\n| where ControlID == \"DS.6\"\r\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\r\n| sort by Total, Passed desc\r\n| limit 250", "size": 0, "showAnalytics": true, "title": "Security Policy Recommendations ", - "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled", + "noDataMessage": "No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled", "showExportToExcel": true, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", @@ -26128,7 +26128,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Data Protection Strategy (GS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-3-define-and-implement-data-protection-strategy)\r\n\r\nEstablish an enterprise-wide strategy for data protection in Azure\r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Data Protection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection)
\r\n💡 [Cloud Adoption Framework - Azure data security and encryption best practices](https://docs.microsoft.com/azure/security/fundamentals/data-encryption-best-practices)
\r\n💡 [Azure Security Fundamentals - Azure Data security, encryption, and storage](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview)
" + "json": "# [Define & Implement Data Protection Strategy (GS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-3-define-and-implement-data-protection-strategy)\r\n\r\nEstablish an enterprise-wide strategy for data protection in Azure\r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Data Protection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection)
\r\n💡 [Cloud Adoption Framework - Azure data security and encryption best practices](https://docs.microsoft.com/azure/security/fundamentals/data-encryption-best-practices)
\r\n💡 [Azure Security Fundamentals - Azure Data security, encryption, and storage](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview)
" }, "name": "GS-4" }, @@ -26242,7 +26242,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Network Security Strategy (GS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-4-define-and-implement-network-security-strategy)\r\n\r\nEstablish an Azure network security strategy as part of your organization's overall security strategy for access control.\r\n\r\n## Strategy\r\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\r\n💡 [Azure Security Benchmark - Network Security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)
\r\n💡 [Azure Network Security Overview](https://docs.microsoft.com/azure/security/fundamentals/network-overview)
\r\n💡 [Enterprise Network Architecture Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture)
" + "json": "# [Define & Implement Network Security Strategy (GS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-4-define-and-implement-network-security-strategy)\r\n\r\nEstablish an Azure network security strategy as part of your organization's overall security strategy for access control.\r\n\r\n## Strategy\r\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\r\n💡 [Microsoft cloud security benchmark - Network Security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)
\r\n💡 [Azure Network Security Overview](https://docs.microsoft.com/azure/security/fundamentals/network-overview)
\r\n💡 [Enterprise Network Architecture Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture)
" }, "name": "GS-4" }, @@ -26356,7 +26356,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Security Posture Management Strategy (GS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-5-define-and-implement-security-posture-management-strategy)\r\n\r\nEstablish a policy, procedure and standard to ensure the security configuration management and vulnerability management are in place in your cloud security mandate.\r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Posture and Vulnerability Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)
\r\n💡 [Azure Security Best Practice 9 - Establish security posture management](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#5-process-establish-security-posture-management)
" + "json": "# [Define & Implement Security Posture Management Strategy (GS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-5-define-and-implement-security-posture-management-strategy)\r\n\r\nEstablish a policy, procedure and standard to ensure the security configuration management and vulnerability management are in place in your cloud security mandate.\r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Posture and Vulnerability Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)
\r\n💡 [Azure Security Best Practice 9 - Establish security posture management](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#5-process-establish-security-posture-management)
" }, "conditionalVisibility": { "parameterName": "isGSVisible", @@ -26475,7 +26475,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Identity & Privileged Access Strategy (GS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy)\r\n\r\nEstablish an Azure identity and privileged access approach as part of your organization's overall security access control strategy. \r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Identity Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management)
\r\n💡 [Azure Security Benchmark - Privileged Access](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access)
\r\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\r\n💡 [Azure Identity Management Security Overview](https://docs.microsoft.com/azure/security/fundamentals/identity-management-overview)
" + "json": "# [Define & Implement Identity & Privileged Access Strategy (GS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy)\r\n\r\nEstablish an Azure identity and privileged access approach as part of your organization's overall security access control strategy. \r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Identity Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management)
\r\n💡 [Microsoft cloud security benchmark - Privileged Access](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access)
\r\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\r\n💡 [Azure Identity Management Security Overview](https://docs.microsoft.com/azure/security/fundamentals/identity-management-overview)
" }, "name": "GS-6" }, @@ -26589,7 +26589,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Logging, Threat Detection & Incident Response Strategy (GS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy)\r\n\r\nEstablish a logging, threat detection and incident response strategy to rapidly detect and remediate threats and meeting compliance requirements. Security operations (SecOps / SOC) team should prioritize high quality alerts and seamless experiences so that they can focus on threats rather than log integration and manual steps.\r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Logging and Threat Detection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection)
\r\n💡 [Azure Security Benchmark - Incident Response](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)
\r\n💡 [Azure Security Best Practice 4 - Process. Update Incident Response Processes for Cloud](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\r\n💡 [Azure Adoption Framework, Logging, and Reporting Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/)
\r\n💡 [Azure Enterprise Scale, Management, and Monitoring](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/management-and-monitoring)
" + "json": "# [Define & Implement Logging, Threat Detection & Incident Response Strategy (GS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy)\r\n\r\nEstablish a logging, threat detection and incident response strategy to rapidly detect and remediate threats and meeting compliance requirements. Security operations (SecOps / SOC) team should prioritize high quality alerts and seamless experiences so that they can focus on threats rather than log integration and manual steps.\r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Logging and Threat Detection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection)
\r\n💡 [Microsoft cloud security benchmark - Incident Response](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)
\r\n💡 [Azure Security Best Practice 4 - Process. Update Incident Response Processes for Cloud](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\r\n💡 [Azure Adoption Framework, Logging, and Reporting Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/)
\r\n💡 [Azure Enterprise Scale, Management, and Monitoring](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/management-and-monitoring)
" }, "name": "GS-7" }, @@ -26703,7 +26703,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Backup & Recovery Strategy (GS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy)\r\n\r\nEstablish an Azure backup and recovery strategy for your organization. \r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Backup and Recovery](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery)
\r\n💡 [Azure Well-Architecture Framework - Backup and Disaster Recover for Azure Applications](https://docs.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery)
\r\n💡 [Azure Adoption Framework - Business Continuity and Disaster Recovery](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery)
\r\n💡 [Backup and restore plan to protect against ransomware](https://docs.microsoft.com/azure/security/fundamentals/backup-plan-to-protect-against-ransomware)
" + "json": "# [Define & Implement Backup & Recovery Strategy (GS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy)\r\n\r\nEstablish an Azure backup and recovery strategy for your organization. \r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Backup and Recovery](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery)
\r\n💡 [Azure Well-Architecture Framework - Backup and Disaster Recover for Azure Applications](https://docs.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery)
\r\n💡 [Azure Adoption Framework - Business Continuity and Disaster Recovery](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery)
\r\n💡 [Backup and restore plan to protect against ransomware](https://docs.microsoft.com/azure/security/fundamentals/backup-plan-to-protect-against-ransomware)
" }, "name": "GS-8" }, @@ -26817,7 +26817,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement Endpoint Security Strategy (GS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-9-define-and-implement-endpoint-security-strategy)\r\n\r\nEstablish a cloud endpoint security strategy.\r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - Endpoint security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)
\r\n💡 [Best practices for endpoint security on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-endpoints)
" + "json": "# [Define & Implement Endpoint Security Strategy (GS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-9-define-and-implement-endpoint-security-strategy)\r\n\r\nEstablish a cloud endpoint security strategy.\r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - Endpoint security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)
\r\n💡 [Best practices for endpoint security on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-endpoints)
" }, "name": "GS-9" }, @@ -26931,7 +26931,7 @@ { "type": 1, "content": { - "json": "# [Define & Implement DevOps Security Strategy (GS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-10-define-and-implement-devops-security-strategy)\r\n\r\nMandate the security controls as part of the organization's DevOps engineering and operation standard. Define the security objectives, control requirements, and tooling specifications in accordance with enterprise and cloud security standards in your organization.\r\n\r\n## Strategy\r\n💡 [Azure Security Benchmark - DevOps security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security)
\r\n💡 [Secure DevOps](https://www.microsoft.com/securityengineering/devsecops)
\r\n💡 [Cloud Adoption Framework - DevSecOps controls](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
" + "json": "# [Define & Implement DevOps Security Strategy (GS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-10-define-and-implement-devops-security-strategy)\r\n\r\nMandate the security controls as part of the organization's DevOps engineering and operation standard. Define the security objectives, control requirements, and tooling specifications in accordance with enterprise and cloud security standards in your organization.\r\n\r\n## Strategy\r\n💡 [Microsoft cloud security benchmark - DevOps security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security)
\r\n💡 [Secure DevOps](https://www.microsoft.com/securityengineering/devsecops)
\r\n💡 [Cloud Adoption Framework - DevSecOps controls](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
" }, "name": "GS-10" }, From e4303b9455684c2f033c87b8e358ff73b3e7d01b Mon Sep 17 00:00:00 2001 From: maheshji001 Date: Fri, 10 Apr 2026 12:32:16 +0530 Subject: [PATCH 2/2] AzureSecurityBenchmark: bump to v3.0.4 Add packaged release and bump solution version to 3.0.4. This commit adds Solutions/AzureSecurityBenchmark/Package/3.0.4.zip, updates mainTemplate.json to reference version 3.0.4 (including resource description updates and minor template cleanups such as removing an empty requiredDataConnectors entry and reordering a URL field mapping), and updates ReleaseNotes.md and Workbooks/WorkbooksMetadata.json to reflect the new release. --- .../AzureSecurityBenchmark/Package/3.0.4.zip | Bin 0 -> 106793 bytes .../Package/mainTemplate.json | 23 +++++++++--------- .../AzureSecurityBenchmark/ReleaseNotes.md | 1 + Workbooks/WorkbooksMetadata.json | 2 ++ 4 files changed, 14 insertions(+), 12 deletions(-) create mode 100644 Solutions/AzureSecurityBenchmark/Package/3.0.4.zip diff --git a/Solutions/AzureSecurityBenchmark/Package/3.0.4.zip b/Solutions/AzureSecurityBenchmark/Package/3.0.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..39f9c47c4f3abf356a57470692d0ae60577c488a GIT binary patch literal 106793 zcmZ6SL$EM9w55-2+qP}nwr$(CZQHhO`#-kr)AzkWS65Fm$jWF{Qv2IkiGnmR2nqlI z00h98VU*5+BQLupBmh7WApijSf3wC;riL!2s+J3kag-9v$#HT3DEm2VK-#>*97}X%}CZ!DiT)g-kktHv_F9+0;(>1QLcN}$Ym&v5PXU^}ItWX1Zvp!$% z!>N5sUtfO=c<^s;2P%Zl5NPQZgV^_&LrWB zKX3l~G#G9T5b5R`i)3oIt0jv4O1|xVdqiwf`RgNAyz`0aYM-<66`pC#-n{jmAZU_w zWh4j*BIuY}Avv}NfexOvvs%F}b=T5Eb(%@toz*%CFNnFc8@r%5XU$uYc(YT2KzkCc{UmtmA(YG3WV@?I)OTL zq<0*uh8kM};5c4eXFx}!M@o|OJVB%{G*L<6A%N{!8dh~ufp8cO#X#1@gEWN6mTbwM zgB^Du9hH!fG*1Qc3Pcz|98%y{Tuj)mxHToo&`D0nB73&`a)xRR4njn_{Ylg<6b7`u zV76tz@jT07nJI3Pu%V)cPL-LjR?53;HiI}&0=-FV7E`@+fk#W8$;F^P+6Ac+eGO?+ zgHfBXG;9Kq6-cYc5TL~t5QD}KvXmE7p%9vxl?S^jRvAFm!JxC`JlXR)0-&1i&Yv}b(ly5N~!Rk)?D z?BsXOphxGYt$&*A=1{fpWqqMr0U{lt+HCn5Dvu4$l`~tSKe6>);cvdll*5}9oleg( z4D)t$2t(3@37okwdv&HcbphCRqq!%O3`xR|7ywFVi$$$$29WRNKjd-Yg+Yyf^Hpg60m$HL#>Z}Df~e%ZJ?+Sz?kV|VR*wrT75 zAA#a!^RRPyn#w#(*1Q_D8$qeI_-;!@mI6po6!21T>T(s-l1pD7xH> zRp&{)@DBJENpsp|tnS8u!AGIXq)JxLnaoE^oF*hu@sfKD0j_0}QElT3_t-3+4fP_#LV{4>&(y0ovty-`i(%^5!oo-}4jg~zq@-b{^7_8PzM zf{LckNK!=_PhS($40y&)Br!{!xe2Bgu75U3)E07ji&1seMr)3HxHWO)}?u5t}MA>r`CI?$*Xw znj30$O7`)lKb!N$x0iILYToQxz&cR}XL&VJSAdP^p>w{t|0To!o7EBS-ux)x{>Op&0aW}@1!i$TiCY9iAr`?dHX4_H*A2#0ZT z?ghBx=4;j|BAsii^HS?*zZ~4}hdvBUy`Q4lA9>K3m#Z~X3cX|jXvoJ_t>wbh$t2T} zO>4=@>yS(Pi5#-GzmN0rG$d%Tj8m)nQJ6`|(_64P7%m3Z+m?Qfk+e9w8K^lFF~L%8 z_*|ZYdDFXXD5wK3ewiQ2lzpFEV#B4})iak+n+RO!AbGr|YHynu2CrAgu%j8fK6q0- z-5TRPxwtzMs}0EeShS7~yQb%>1G&k@cBHY_vZ4<@EuQI1m=-VnUa7Gs_3AzFc;L~3 z2y0Ub(eWh2h$Z3&k>Pos92C5I)C)-Z1`F8Le2R}(0IHOi{Si}hW5xqB=;z~^c>LXp z0xuu?A~UNctFK=C{OcZ44}Tu}@rNG(SMEB;JC`9BuDgW}=u8KiIKsVV;o|;|7uZbS7@TY^U`fvOHpT zeJT$ET{%I6rf3!1fb?2`){cwt0uH6#T6!iop$SAz|wQuG38_v$=TM$9)}y(&4rFmTe6Dnq0%r3NuzKgmfm#-^GB%f*4xkM zPY5qKh(rR2eNv9v(vpdp2@(g#KXuSCo zW)TXYq3}#%D85%N=NpEAK?wo`BII>qaE?f3vyeR09Uj9t#%$#~VdyXaI0a3Gcp$ET z%AlAVES3lc^!R;4hh_tgBz%uF=2VG&8=5mt=dwYVJ-DQCvh0NgxIG2#KjlKg-=s@MGQtX5UbF*}vFhEBP=1fVTbef7g0 z5A4o7&9N8_KE_OQ-N6Lp`P`?|d3cGPLehs{9N!O`$y9Jnd*5d0O^?n!K>neC+*itM zCp1UNk%5tP9b(I)WIP94;W`1dp$|!ugT`5y@3mVpon_1Ex0~GD=*!OXG99L7BfDzW zlXfSbLx3V3w7hO*r+tMlvIZD@i%A|aBu#E$!6qCtVozVRkm#jKovzz(L3lxWaUr^N z5hyZAl4hl5e{}@QCJph1hW{lkD*YMK< z_rE>hHE#!V3Gnn&U*|hKRf5U@kPwY0yzE@Jna6IYn|R!RS#v=B{szqS1Ab1*Pusdn zbFcHR0xrrp}B-QvA^-Pl}f{K9CFM&+k8Zc0xJ zh$kb?vkM6=iO7)W;A@H*rZrB|Z*zD=tG8{H>!A={cE*#U|hx$d#7=!ZyxmF(pf z18n9U7D1T4VBAHlotXU2^%-Xh;|Ae$2{S|XXEAf$o`}93GUXa0S?;qEM#cbD13=7s z1xzy##PLInqjlEOrI2>$lJYQowXPO%tQG^RnXkjRaH0^ zjOvc@fw^PTN!q0*+g_~(cOusXzDVun>@q1ABEdoJAWv}SD#HW-7OjA9n$?ZcT{HefC;AarZE*) z)1{kFwF1QRd0gMl*O@2%*G!Xu&CNPSNxzRw6uiS9lBZipyV{K0jGQ^y_n4!6!Wr}3 z7IU8J8_`Nf+-B1K{r5Z6(; z1~&UeG$qzb#=yBu{Q#i}f+^;9qfN{NSOsVrRK^Q4oTdmX)jP@S@CTlTFM{_ za{Msk3p~pa)jvK`ewC^FSbIV(WjJ#_l{EGNdlvv!EdvYHphtB1G~m>`%?0F!%95IUvkZ5XXn#0ko6 zuz+NB?!rjwsEhzrpvfFY-6lC*;>W^zO}IiMjbuh5!MX{>maK(rx5?9CXe^xU@A%)( z(}XE76RgMh5(cuG_dwFE+50Ittf$3==}z9(4`^Bd5ibRxqd6x;B%}tW%)7`Mc)i#; z5@vxOb3O;(FHl>B4HTZlIjufT9``=bKXyYY3DdthAZ@o{10QosT6JbjX#YrwBqo!a z1AutuN%(&y_QacGeu8>E{wsRiAT4TGfI3(rL-1z{W1qkjN3!G2pN-CN)?YE46<>@y zA8)u$p2BcG`Gfq-n=DE_*c+PdFE zKqh|~dhabwZx7ImUmGBlVpRPRsn)ar4GyS*L%&0=K5Erp zlh~aBLKS`F_CnYn=SxlL1QW`W@bb9MfJI0w#u4OBZ1MvO5aUV-zf zxClyd_?*{SvA;5Ia^G(OfEx=0D$CjDtJDhRco5}}9|yh72cJgNd)g0sQEy3yzSP)u zK=TdVC_@#x45Y7A&{DNnrk!W1V;>9{5eA_L!Et^9Rb4y@#Z7N z3(@heFrGWCK0U9NiY+2)Yi<_vUr6`)@4~0SI9{#ZUWC z9UzK}!^L1;VvpvY55E(S#IQS4{e25SCSx>@5a>fZ_}9DmYoX|xVD#rkfZHa7GP9JJ z{I!vzHqBMceoz4W<)iFs&;pK7y{|UAQe(BS>u_g|ZdzgvEX{Fz`7iV?(n0u*G-pG- zkDt$-XiZ?3qOXc&vu86Au0C9?x=oI2hOp)^ZzCyO#zy4{jd2X(T&z&N8*CLI-(4dy8K@&3dzeYCVRM9e>q%cQnk9u#Y5e5^JHF|M1H@)|E;Y z+IqB_`Beg9ubFstQNB%RMCu`o#%SOX%(zM){8D+UUJ;4>$AAekajtoFr(LPgAfMK$ zdYjI9ReEHaV8VdD?cNKavw1lLW6IkzorpIpp|kbV0q z32e!JEE1wWEvwHC)172P?541fH>(Q9rt27$m`Nor-Zo|XUQ}$xRy$A$Uow14?%9{^ z_h1(V0|aC)Ic83+JUn~Wf~QfWQTtiQF7r(veqe?GiG0q7wlJ6A_F-_<{~o}4V;&VV zTWUGqO0KG=2FkJ6@WygwXo6#J_b9Q6>{c*(5QT4Gml+1ddSX)X@u(v|3!0m&e>I7m2AMp?BsCe3tGgkxvhfU?O+ z{*ytRZ&Kyi0(CF3qEM`lRVty{70lsWZ~(xaH>T#OY+hjS==Ji`CP;isXHS;1&?VmR z@F0@!^5a=8DFiGvKB92dW30V>eZ4KR43&=Be1^p0TBZ^swKpog6`E+JXRbUH`$uY{ zw9|0$bZjgg;yDgB1_^M}2u|Mk!1^){M6|4h z$*91IxBxo|2U%qX)}7}^>d8K>86tRrBv>rH-a~000v>*N zVLg9)?L+sRgidSzY&pB{pcgB^b5m7D!pY93mYOiddXwvJ8C~l8Ag7q;5VqtwnIs?h zFTbBE`!eV;>Q_zQNkraBWEnvixvo^TXz6qFWh@4(S&1yCBhO;li)P~$@?OsTjQ?M& zE}h{G^m~?t*e|&}N@zW)jaDSSeJEefL(T`E1w%pwBkr&!AqMd2;f%s4h8HE(SoB*Z zu~3g8F5@BWC`z8ljdna5e`O}LL(Zq5?A8dg$lGG++p;(Lr~b^&b7{CW;kVXph=Sj8 z@QqUPOoe>R#Ik4r3XggUxwp|&)FcqcOJvMkIMp#TqK>FVjurgmkvv+?sh|f*aEtpR zN}Ay2>!>;EPVs%YxWkBJ?uGmkJvrTGf+l_Z=iyH=UrVf+JI)5oc*~c$FguBQoyndDn@Xq`r;1Z^&5B@4N=M z!v)v_Vf)`ZvhzJt?Rxom$A4WXgMPU$#)EA43XRTQLQwArjxu?aWgNGC826DO>Wh}% zIgSjF8iu}V)*2(*Ug|KxrDJ`MC0)1hPl~dSa7@;0vss&%#GFzQl=aZfF3XS1P z1cx1RM07F;;_I8GPVtG|1>u79ig{?1Ti zzg3+qXhb>z4gYDKn2K!QC^}(<+fIE}hGRu{LISm2$fmgGm;@56@~Jvky-4#|7R=;K zu5lJ$<;=)+tt6;*8E&>*w9!2CG>GeFvbk<12stL_6wB4Bye1V`CfxPf1?Ko=DZ;rL zfh6bxV^~-~+78|`G|`2N+tIM){y_ZgRs}Feb}d)O`gX8?R#$A%%;Nix(qmu9MdOYD ztb5c680C_l<~wG%hO4VG(SYl^9Jx|7R5Mv)zUN+k%@J1vFbYYJrf7as;+&E`9$S}`T2|92Xj9XUppILo5TT9YiY7i)?RLBZq6-2Fx@e!$Yp8RyRittHnKHU-H`+x zV~Wl8Yb1^GGi2HLXE%tmWwZQAXy^jwoqS9qVcfL6_dVx|B~l1m(mk_X1BNbGw09u) z8frA~ggV;Eq9vX+oPk1eL%iZfrUTv(H}W#D*9^=9d-J^?^7N7BDqnwJA{SxnP4+vU z_=|bQ{bBBPOr3dJ>^ifN!OD0=8@W0vz528B8&#V^aK9b^Is;4*nfFxio`FkW`&+`_ zSG^8<{3Zhc@a=;BQ=#%{R1pr!i7oxCM^CeI2%Nw741H~jDQ%%xhSMZ6rlC}?`d%fK zg?8_*&+x38<<;wUO=q`Ktg&gS+e3Y`iQ>Gv$@<;)fJ;JeUo6y>i|l6Gkd{H-^?WOJ zO)*RsUi(+lzk7}!?JH+|w_Kzy+mNSH?V9jn?DZYUQpkTY|v?uR}Iwn+VrL_fMFypTqLg>ikzj!n7xqC{%kvgId1@ zydG9-u0;JlQ>TuwdqN7E`np^VvX0J~?hSA{CVfG3*^6@z?Mn1W6>F)A(r}&zvc-c` z)Qs&iO+im^@+kI%B;wJE-ot|6bY|)nMa~L79V>y7cqbmL~L_Kuc2tv%jdHLC(}_b|8uIZkwOAD zTz{x{Hob(+CM39m>Sx+jJ`a6Aw2A;5tI5M#T4w~Gf#2fJ|1yr+OSPun&!(@Zyz(!< z3)+TW<4uo^>UUSD_8QvnzX*gNA~Usd*yfUW(}4H(zDjOQ)6QQjuWMgtFXfxQOf{{u zx1#WURH`S_$@Z_1t*=aL%3^Y}9`&bQ8KrRqS|w;8>oRU~4(DH&Lcb~~R6Nd2I*$y023i~SUWG^a1&40QXYpfFM`4!py zGBNRG^W@qe=d*hq*Cf+t*DKO>g6!?`(oR$IHmVb%*gID9j-016X>ZF+4;}V z^LgV<_%(fUV)jpMtk&eX42`Y7(?r?v2{wur>9>o5igc&;<2m9v7*_subd@^zm%GOv zhQ$%XX4$*=4Lf%)nx!u5hb`4Td&=4uH!=gZL9M;Sw(Sm9IbhFss~2tnu>8fdEiU<(b;HrfFiP+--Ov68&InJ7LC47 z171!=usy1kc&P#B`sQYrIyKnIZCrjD{>=IE0bkzozS@h3{#`BPUVe$)g2RW9wOJ-p zh~&jo_UiN*h%&LJpGoeySv_3Z^o32)`y+fCWDpCi0W6TUlgVfzJ6B!x#6?z?RI{XC zEQsK;ntrf@OI^ZNspeEC63~tpuo}PLCm!dz<`7H6kKh!p01DQ5>h6QYp+QdRvjB_Dgp6nD z^phregMBR)tQCiU-z~s>eMI-+@ia~cE8zNp=IVxvc5R`utl+}S!MWChdy}-z2Uc)u z(@qtCr#**Da{#^Plg;+-S^{h4UVgF+2HotNHjh3-xK5zYu--msN9*mY`w_&EL#NM> z3)no1j*>y2NMF(3IHBEm|4(JA;F#=zD_<=20Y8;=p_YA=Y?L#ih^|kMjG*yxS^vGi zC1eDk`@0hk9g8&v?SX9 zYdcp4gUlDmC(cRTlBLVLTv{woQmz7h$7Pbb-2Jez^TgT4UFr(}2BJ+XQc*%&wf$e!~ldas0vR$@sHCjtSjneE^HR-QP6z(T1Z+<{-;`Sx zN%+K*FZ(AMmAYh8faDw%C*6>aA)G(M6D3mkYT3K9vfrN9C%!$F8Dtrp_|>=it8cXa zCP4kJfUpYj{SyEWx)<%ZIYIlR&^$G=~LmU+MxEKu@!?eC#$P=BLkX|pHszqkIsr+>$o&Kz$hZHfgz=*d%1aYa`NO7Z}@WZ@}a@__-&ZKzhu-8 z^8tMjB;8LSPe6R-NW>NwY7_O*sR5#E;EI2}1k|c%#_*cKuH(%`EhWQ^r+weACm}#E z5=97DY=W7CIW3_t-``ree7%4 zS#3GODHFDITpc6EKN?Ob&$IiILmm>uA9GA%Wu}{1VrcR};baK*nLjN+D)GfU5zObJ z{DNZ75cmqbI6kYz9D!P;7#C&9VIxq0+&Tv(njI~IPNZO#!k+uj0vH*ik03|eZyl{+ zsbZ0~4NrZ*{8UY>(ZY9UfXGt#x^xZ23`EhocVpR4V4Zl@XUcxR58LMa0>YSGG80=a z=x5ItJ!mv+G^Io?xsY_|srnLsuE83FDtt;@S00OWAApf_weijES7E-EBVf0#}Wmlramv$L}9-BFN2G?y^-93c_=eny5d+LCZi)_~ns`rk)Bb)fMYh zMx+(cEy(GSKqG~VsEE0ixmZU(lI(=lP~h@nZEJ6D6 zgSgTjXUHjB!P9atoC>>s3c$4U1dAQzl{U*WjMWup4qw5t5(K@=f@}x)x^s`KopM6w@-J~-1-=4cOgAL{9r2wzP1uBl z2_dtf`V~RKf005x2~4g@e-lGvtj0G3+>g;M*p&C0prcdFbFDmLzwljt6b3iu5y z>_lricYg)?l2reaEHRK6x6eK@A{xn^y4cZg))4Gzqyn5+`hv}!z&_{X$u{mD!rD!u+uVpX%>GEY zAD+Mk)QH`vpgrks;5Jj&j2+mpP~cyIu>8NDt*_J=L{}D2STaYyf6BKfJsG+wVIG96 zA1UVACod<>PL4@BIM3Q%=NVo7b(fyc7L(S3F2wq|PBYDnVt~bGdV8SG5pko~7g#1! zNk;Tm>%|kEsyUG3xV^fF;ZVLhG@wsJnep~rbP0%b9aEg>)ZmqaZi*H~ezeV;b|U$- zVwP(ydEg^>NSRw_ls=y6ixx3f3Ox|X*I>`ugB%Asf<^|cjg`W30%<{~JqleY z4M5(-Zp(R+P-#IyxpqS!RPzhGW#8>D+T@GgGjz`0@=-Xhq~aq(o) zMv6^m>nM=~Jk?X#5nr!IpogqMi2Td?_nO14Q=Lx#4)Y;f6g*up3-p&5D*?ItBh5QV zD9Ab{OFum5yL@{*%sE=x0ywhZ>Ygufj)1h`C1DSI;2&x((A;DmWWi~vqD zmfd|zUY@OHUPML`IYc}hNp)aMCn79X@8t`>arA+`I{sW|6T(xpJddAfgzy^yRAr$_ zKCfxA5bg$`YDUcw6R4sKtlwwmij@#-x#p^rBw3JEmiyF5gdGMb%_W$9go}?YGB7c` zR*8(WFThgb#aqzscTDsJ(+8bUNwBhPS=7so%F|>W58DMQen3@dro4H0-$rt}78J58sFrIPT(9h83JR^FnX~0kzi-;kD?p7ukrA+@wQ?>FDee?f)%Kv-NzuvV=GKux20k`q3h3zzLiOryBRF3ymLbY)e$R%`hGuK}P)9ES> zyjX{^lXltQj&ujNuODKmNuTg?o(?vV&Jr@vRV6`6P$Fc+-G6g zv4U9o59sS)fub_)2iy$46g}m7HvkqvMI9bAM|FGf*y)ZuroF#?Kx>>*O5Q$*i%^SpJtIM4j>=s%}tWu$COAAjaSMrQq#LIDZ zQMbEM!HkaXL1tpW{{GEIq6j2CURL2W+Rs?)L*zpjVEOflaczCgoa>%+Xh(N9j)tsg z`E{r4@lLM^w+hQd!!MH)(X5)|}VuF8iIKFQGI5+{#R896=7owRR=mH}K1YQOpVkn0KCMbqm#9>%C z(gI%wijs@sL=hm%G{^MGZd?Sla*%yV^w*DP8X%~Bs4&D{3nc#U%ssC;7=Bm{LM;)Y ztsXCx4E1X&jT{(e_p}C^cIB59-UMVXN)gc=zj2V;PE z^K~hb7{AO3q23hI{!ytnHJZ?rg2KjQAv7+DO;#YblKDhxy@r7Sd}hlUn2Lp76wtNy zW*l@uCxwtw)jUxu;H42!IAbT07~Oyhw`9cp_7S*4(P|<|#+$lKKN&HG36hsc#bkmQ zi5cBQ@0Wwh*=uRW7DGyY_yiW7GQ;4NR2-t_t{^gFa9&x1|5_xW4=o2$OG;j}qoPB$ zi=l!)dQqwXbMj`zru;Kj;rrvBNJ%b2Ex(^l($^QzSk4~W+vWY+EOo9HQf6(d!crO! ztjKVflhl%tTWfBm!*#2nRTm9OiU2|WRHW3ReXnY=ZlRz#{zhjxkVL_Yow{>bgplH$ zw~!3E8r(K+oWNchQ4cjRq&_1MV>ZDSj*heTRw==`IPIn)iYByPBA294 zwBd+HG9itD$u)cns7H^?XtGA?cIpwSVdF@coHz6xHw+SwL^E1HAq`^MV7`>AEw7RG7U>9?qhfimJjWn^RTO^vUTgx5s_jr2*3Pqku@G6Q5*jtn7<>3y; ziyc%dzn&8Km9p9NEc@8x{77=gvEI-R?AYDPx?wmr6jfwdbl*B}Z}Z3Q?sI((gt$l& zm1l(XTg*iA!Putdw+_2)Vi5#k|?!R?+ka6Td(F#Wv-Z- zDfZ|*yp8lS!ia5CJo1*(zdaB-p~CVnce=Ikxie7bwcGo=vWY`(Ln@*AiEGoxuP&d> zRwJ)3oj$@d@%JpqW3$JFxu0I-;0C@R&|#uFife=C2U@gzf%USW8>y4(D?a%VerfTX zo;Y~=LiSN7=J-XV?H>oh6rq$USbVb@g2o>RbRkj~L}ii^J~p#NjVJ)3J4eczA`;R; zxNWL+S(;Nsq(hM|9G3;T|FL0{%6`D(thH(h6NIFrBLjb*$e zujynQK<^keDexsg+yJZgDhbB%^Y|;2-sqw=td6(Q%+8rc?3|~VyHpWPw2jZokqK@xLUoP${<`tMnUTd+22aY>^1MFAWIE%hkq zS}v+e*?xHD7`5&OTSL`QcUMA@Vwe3FQQavrVo-=TTkIINqfFpg6a^XYF*Rc?O-yjc zxEliqS_Bgw3~jP^;GI?`WSPjJ%?MDz4jvhNfm+`g0gnb*$6Y}mpI?SC)Y=@cVMD-8`3|gd{`h@1Jn%bX z_yxjDKdh#~TOicy?!OR&dd&gHo&_8(Hhi%@U^KtOdxH4?05S3^EHPax4}9QHR2*Z= z+N9cdCsiZ-!Y?%ZB+7?0_?*v}{LBLtYJ2|njMVD|Q7372w^Lk`la|coF^K8*aT>R> ze0E!{Z)1LAd(;C6htM7F_NJN3r#g>K{Pcqa)tmLrC7$mO;#M)HSVJZduA|yBvW9~B z*5YeZ90TM7Xx97H>yP+ZYrEqs23PrcV6*F{e_?B!zu%kE-;$p6$fiDH52EQ$Xl|<2 z$}()S8vN1+WYAxJc;68FzYu4PFoR%+$u_@xm|}mCp|K-(G|v8`4Oe_GtnFgDID8VQ z!2gaD1U?(oh90hXM!qBe81u7|2aiK-K$(9&5SWO%xd>Ks|Nds!1hB#D_J3E-&`j=t zs8vYjgzv-#hlrb{JhIFZ&pU?|qS{RX&Er?JW5vvS!wn9b1=7qFv4kwf?~(+fT3tUf z04gH<7v@XxtV3QOgwfnz2T}!@_cMwnkX53NXHM@ffK%?n3FGb8l_YN^CVO|@fzO4} zH2eva4*c57KylRJatR{<2%2ykKpz9b_f8xY-hr7VjFqL@P=V_4D4=;fU>gTcusorV zapRu~PVElJd!B=F!pkT?mEnRYru;Vs&%?x(3Xbd@FORqHg;<@IH%X_#MF z;8C99(&`&~SVz1&nV8_3QN^uTt&j6XjVorY-uYMTt&#_itPTsZY4Q{owb9O}DAc^m zj78D2Mr^A7Ql_w#gt@`TOtJ2u z?m=-{3wXMf2wpt))PtM-DF8S3qnvb;B^cvQB$4~^63n|2=x$?N1$q_+Yo285!>>sD z7IYc+uY;7ttFEi9dKu{DS{T^vx@p7jS?8+Y8opc!a_+1axQtfRL!Q>cndQ>5A^_fB z&ElN0@;$fWvr1d{rl3Sm_N2K$C<~Q`| zIMN^NKbv`!t?v(vGkos@ItQh*js}f!tfzZe9O7x>92yC=+B2zRDRO?%l-I8JLM_Vly;MZ9(G^zeg$XD zMV)c`Eojd36z6^F^`Q>%TkmAhu@gigW|kOX3*6kzT^<)%(;?J}>zcakDerA6D(-qc zOjYZJ{uo0Ore2D)ZnfgiGjGt-02HNe_oo(kp?gscQ1Me=C4I2M9FjC75#3t-kz^e2 z))#~9s*DqGrb`rDjYm7#J@yani!t-r;PA#Fw#fdEU1vo|Pfqq&?|PMk*SPS|IlVrgruAEph~tDh`BGt_L6j zPvcVv_7!wnDnI`3YvL#Owem4gaq!J;j>+5QV13e)U;7sS+Wj7Fboc&BNg5bt+KtJF z=?WO`EJ89px++e_?x9i5naFTtQ<=4+=#8sx6m?bonUs#ICoTG6)YMfMoVrSX{ImmT z#EWidH9*Y;k&fceUfm$7!|v+kSEZxKj$WMMhYpL;%11T(boa ze|h00Ji!Y>=vwZ}ugdxm?I4PsW){c;<-O?*AC}<Rb)%8XCfLj!;AOIKfk}|OHy9hPI_v8S?*l!X&s@}2Q;x>(ih(W zlsznHiF}vhA_v)Gc11iG0eFfoziMyAD_<5bN7fJQZS~nv_SM;qRk_^~flgn5WLBU{ zB_&6(lnx+O*E!0y38YL&CUF3yWXOoo$~xmGaO<`o3qVLwvV>b3cPOY^!|>ShDumy?oQnbths+^fk>D|qk60NVP=98BT8~2kMED}f!I#wImbU& z5u1_zT34h;^h76l*gn2-mp2}fk`onz`I)EyH)HnwZ2rQvzJ3W{#D_3=wQ78L9eodR z;D4dW7slfw-wtEKmcE zlV+)4rO5ryS1Yo$@s;cQqZhuP@WO+2awm$9mFTEVROszK28!qB_`gg}-+xm1|0?EA z#Kpkyvs)Ajx47}-mV*FyEu}51<=9PE4QmFPXpQGTwB*9Z@`|xxD$*LyFuddb-=V~` zoSYonmK^KjUkh*e79&*aP@f`hO8rI22S;F`oAc@E98`<=B=U@>RXeo(F5L%08XH&g z?%-Y;4e+dy;?ka)LU&DXZGji3x3=Pm(ra7Ll~z(j4>rU+pjE zX|LN}VDi5t0Gif>$6(lyr)0(QvUiftjbp#V(hUt1)uXQ2?u-z+SkMc_O#mm?D)D1r z&s*+A(#GGDxvYJM%pI>!ilVavp~$))A&cFi{N^9HGwvx z=!?A9l_MnavyD?RXJbh%dDK8gQL1FVrbyG0#!+*96GXw#he5@8DqS)GQAWEC(R+P<}c5Yon#H!mEm3>LVsflUQB(R@G6;?2w8}-wsLtpc&eXpxr|{vl`1yzQ;~Y7Rnaj^y}H%L9ICYth@Y;QUUnR( zMcAv7{sKVlRCR6DPq!uQE#Se^oo$anb-rOWC`mr~bs*1nCzS1-<#a@apgEQ>QBs*Q zhl0n*#-?yt*jSWY2O0}AtHR-7XHoeBY_2Fw22X^UQQ=FlwWvQDG!>>cfv3pM^6U$O z{%(J<{yev<)Fx6DlMBulEzEoz1II@I&4AB7=|3LFio>qB8t9F$^8xjTEM|xtz>NM{ zV9N2Fx!tK}zCQeyZEW+ECC$+T#DM7m7wc=t+Uq9GMwlqeuwUp2OCP&Bp-*O=B#KGU zL5p5N;!^3*1!@%jAFAFl$hM}58f@FQZQHhO+q`XCw{6?DZQHhO+tcqe-^|4PseNiy zX2y>5V@FoyT3HBHw&IPtjB_4oM4B~!DyjmDDiAc3WS{Y=KZvOtyq5R8uz~18^ytGS zI*7Cz9DOY$44(hFjNe0YNQLjYP9|u00+?&#jr|$Iy!}g@jzyNv#O9|7YHmt=3E(Oe z5VmD<$IdwqP5P$U6Ea34C>M9)h*+6)b3FOtzf@UTKp+3;S)#ig$R?r_ORU};0sA1^ z0Xp)U4-@xxrwzMiScKFCpcuZ&R z!~jQSd1)|gFvMPo9)faEd(SmjY_C41%mzm_Y#;(IFzP;RaI{A@@ZYkRhHQ?ua$6#9 zTdsq~m%YFfrN@Ck>G(xN1SWYI8EvVq2A}q{J-H07+g-n$BCqkUp(3Iy>6CEOSXLHyiFWG_<1=l&-r2 zaY>IUB@6EP_3byz?0k=9`GTiOU#CSg@dfKNT3)jB9WiuJO1SMU~vXS<^&~q=}v){7>qZLA>(z3PZhjxdwBu@64j(pvrDE?XY#vQG?Q!`J$$yo?1h6C$dzbP#hxm zFJb)|Y~*aa0iwV`K^7bV3C=$Xw}~-0yy6n&JEm!ceM#x#==ES$nU<4YBsK@11fjr4 zk92Lom^nrgXad}w`bDoi$8PAZ`S`~bG@*Lm8{=uZfn|`#FKZQcFh`xIs7-WUbMJKs zQ_%|KZT7`E*KhgGYk5?hji}>C=hHv~FL$^PQx@14j$DW|ILp~d+D+xBp_P!+RE`1c z|CA_4L+U3a4nJ5s9=X5>`nqJRwZ(j~0H?iJ9tf&c$?%zc)5L&7f^ZA=^3YiXsnf+$P&BJo$l(p=B!{&4yWQBW3Om|uSdilJ^z=9Ft(e%U<&fl=HytdDl!%aOA*NZSp1yt()RR zUmiPNm_)jP-!-wESVXP%q=#j#V}?*EYl8VqE>0UPHLw*Jbqw)+Si~I*B(T`=Utu>crSO5wA)#Z1{OeJWx8fly^=e};m;uZ* z5dW>?p++zT8CMX-Q*5#uV%K;zLR5GaQqLXjP%mQU4GN@{&5JkZ4D2~Fz}nKV$G`J0 zC{1Y8v%~Im+}q>y2foh%Jp=3QW(ulY_~Mk~utsGC0Q$qavE4IV4~*Ptm`7sxibjD3 z@J1Mj8KU<}SJ{PWWy|j@C79ux`V1d1Vm{g$Z5mc~EhH#>J$g0f^s8r-JEH?9(+D=p z;Ca8JmjoZcxU&gXS5Pwid2C0ST|i~hpWl+M zzHM=xoyd1_K#HD+vVr~14*VI$(}KgeTn&_YTtf@}o24vVi23#f0RW5gFMO;HUYn#> z#?ztVR;K%^qZFfkUoE>Nb`F5DX_A?~#e|%qp2);LameyElWHi9dl!`9I;{54&@eCF zeP64vb9RbR26lg(9BAe*;>GEaT`ZiC{VEb3&HJp~ltQKe0V{w|ibzgYFMBIBr**`W z>npa3uOoJWoegkL8lX~?#<5m&AB2NC!br9SxzShsz=9Rd-&Q<$Yi(zK;3-~ji_9Zy z@6zwjz0ayA%=aF98o-6TD85?-)_Kmk4BG@WDzCk5TsZZ5w|R43IdgZpp^=V{ z<02qgIAF29>}<4t-OY)04xpbMRxB@)`L-r4<9z}Z$+&^_>iz)2^5$4jV(2qsgT2K_ zuJ~qy-sN<1R%Jlr6o%SAj$#jx{P5F~1ZdJC000UX=LkK0b|BX>^$$PO06 z$GH^sv!KKuTT_ds^ylKws|~0#yJ~whjkpNMd4s(U5dXAB*5coBG!DZJw=evQ9VX%- zUZ-s_5MMVGrzZ8UF<`yTi*nZ6F&NKhm6taHFV{mQ*g)KqKN95)Kz)|i^u5(j8${_G!c3$RM48ub(E8u4;N9mF~1Fz*s963{ovfA1+qPo?}{97-l2d=hKn@3&9C$@EG+J_ws zNb)noEVz!Kue5%nt%mTecv*4=%ukiltbmJJp>tt`Muoi##$fo$0h6kAoOy=ywrFJJ zk4%3YlLPw+F}Tkz1H3AK2B;o@3>Wb3`QZ(TFKG4Q zW4OdS%SjVqf|hbMuSr9l+I%{m)6v4=Kja?XqMF(3?4*t=Pb)^8DLe_dutV3-iF}b5 zjNx{g>()X&OJWrU2?10i80p{e?TkWaFc(-+VJUSKL4GgeO{PnFdVQdV-#fG@XH?eL zh$=;Zj$Aw874}al{oPKCDw0a^AM|t)abu|97^8$5z9Ds`TN6K)DwHQ|O4I5KI%QX4 zsL(p03BqDa83wPZDLTNB%&8A%NKc_WC&!4+Epcet0u}R#EY9xDA7sMSv_yJQ_)S2K? z+<}vO#_TB4zGI)l0^J7DfUOr*L-N1|G{Kyzf>kM;2qkgr{OKCzWD(|AD4aG<9qPsO zeINj}ymtyv6tMG8;$?gW;b899@X=g#A{78=N$Gw!nF{u>5laKl5IL-CI-nh7s){T|lMD!f%TSU@;bT+mf#S@{*~NIJ2$C;jfz+&DdyuO| z{%{zNA4H7W^D&g1kyHvZQ|`y5xq$M8R+5MEnJckNpG7zxNWXF!lnYpmrp|GmmV!pl zq((n-7d=TPBYL#T`f-cYUaAdfbXQNNZL;nnq4xtVi!H9?o1r4ubO2gJ|4- z$IRUTH`g%ALRXjU#*s9smQ^Z02Y0QR+3aO@+_cmup@4Z@7=;suE&0ulV86?z7Fi3~ z4vYOGS6`3)-DhHn1sx3cV{_k3%e)O~u3p|_iFGYv*ULiiPPrfa*2MP$S`F5pa{EMK zcH#J@wiG&^Cc8F``9oiqIKon=zKmXcPAz>6dT=JR9xn>4dESL(ET z89BrtBD|0M<`Gs+b3HEUT*>CM%*Wx7^bd5Cq$+6&W?FG7M9}&37tkk(+>j#{R9BDCivW=xR_gAfkEBR$^a6N$%hKCu9(a zc{VCGvrK(t-l*t;KdPDNu=)|ZPV86M-Uz^Ae{Ay_<`{>7Ouv?ivNOGP0a5uB1r2-%g%JzQ zwXQe@%2QkTQf2*4Es3A>2=SYsxVjw5J2?Qv^A%R&B4D#EfC7=h{Zm z#@zI{0uwIDEc6*;lDgMry+_06&~5%CI0J}J2_4Bb{yuFbKzq@juLxj8&15L7<6wTP zlhxp(uMx6&5U8QqcbLSCsU|V0qp`Txih*&%HNWlVuCF()-ivuoAG-psd0LfivgI12 zeoEN3_x=;yH0O?Nay#(Z0%L{1DXv_t-p1^M;3!$1bqM5xIAt^1rd+<$jYV2%Kczcw zeg?VzDLzPKnAtVCFzZb$dFyDGBuq=%%vao zCh*DTF6lw5Q~~fGSJ6oe^7lIBNB^r?T+r9?W=wAHbY}-$UktnP=N(J^L5z*T93sn@Q?4IW8W;c6gB@ zMDuuH*@Q+^8BW1|u@GKnK@QTIYwEAZSMgaflqT7Z6_p$K@fb~a4y5XD#iY^*dqb(_ zXWi`175`q{;(m0!>oO< z!hrNwE9Qhlb1>5j^0uU{^{j~GAU!C^DL>J- zFiCJOiWE@82}syzW7_D$KdrXl!UNf-@6<6bw9A+Kjz9XDGF%&2k{FQ=)b|V zv;Q~#jlXbqC2K8wZsjVkU%4ci+^k?CJ?5-nx3?Ud?JubK{cJ5F(OvqLzyQT)k}A3m z$Gj;@kdi6pesCuL@xdM(I67j2r=oY(dS&>+1r!KZd-LmOR8)cUbe7I-0_;N2Rw2Cg zvSU{qD?4JRX+~0he19OgasE?+6`@6Qsz+vOfc}yj6;#($-?6iW*hZ)i*OhWE2_{C- zK7D%Ty<@EGNbgDDm@RIKOJ6I!>lQJQ7~=W*Vxqv7;^&@Y$ewcKaIa*W*!|p|*n_I> z0L^pD)VB-u(1M!F2BJMXC|PDa7$iskTlCvd)6pGu6;5oCq#L}sNp#SRVmcK?!zM-Q zk#v8Izxi^h?Ey2Jgt&QeN;%BFzT;Q|f37W-H@PR!i|>H>NrNmNVFt7>`2(dohZS?e zVUU+HmzU69J2sdCDWn)&7_xhK;Y){NYq*p>1w|^pjQT3Oz+3P?0+~U1 zH+<8QBOa77a`?B`hb`#vVAN>l$dbu>Bd8fGAL2qhBq7RH`8%e z4=>ru!^}CV@A=PWhcX&9s;BfKYD$EI*XDL}vIXLqs8Xjvuk&(n9c!;l)oj9M9Z@tw z>eMF1=z=3C2opElV)k(yEFaS~X2$o*M0CvV5cP8oI>$y6;2=uO3VpdT+#fgCVTu*J zq-(;A+?TTqGNzjRIq0mg`i(|`NUFBq*Iw*;a|^;QXs z62983AB1vgbg%ztC9D;k*@8ilG7d^G{_Wh$bUGr|PN0Znr??@krohN7<9a1DtcVw! zHwxVhq0p<8DuarPwq)d>R6Cdg3b*{1lWNA>ue?~x$sZa@f!BC>d3aT7)qdPUbn!%a z`-#keEUV&E(WP8LeZvy#bXTJdh*-u1+ zQxBkAZ53Flf?J>b+K!^nO;foDdy70w=MHs{5;m{U8@Agt5wL=)cLTItHp$|ZeTa!0 zrah3V*2>L~bN56GP{-UGjtXmVnjDfx)vejH2kv*v#QPfM$S8u@4|>8BcLL+WKDpXo z4XY4H=yBnhrbSNb$Mg4#wRkC!-u_e1>(*if*QZn~?OA~j3VRY0-!zr4KP`!^ayKdQMxHvu6H~`L zKV543mN>F5g2peq2%uk)u5G1C=&x#eirVg#G3Yq`25{bXdl7!p7@a)CY`-;qLZ+hcFDO+M4MkB&mdkAtLcG(vyVKEW*m6#oGTs*JLiZCnmARB zYS87s?)jgFR;vCfRuggTt;A)9UxtIv6s8;aDNH-94!L4i?|`RjHp zSvZeGZ{0L)xRmT%ZA=dW6546kEIDVI&YamwfP9rmf_#-H+%AUYZd|dXTbGyz;6n-n zAREAA>Wo~wh4|Dg@L0iUyGjwFbE^=dD`y3k$bx(gm=*wg?L5P6&_8XV;xcH$?t+AL z?>KaQ8~ApTAY${X5VBYP{^wZ`9#OhA4E7x^Gg!IxeYWc%RokoCuLlAjwG1w#Rn{B= z4R^|A|L|<7qz4j+14e4NWBVU~Kk7Gq;m_cdZPUuTp$r<;^OzIRr-rcY)Fs>!(dLQ2c<&_r0GNdKL?BnXgAk?H zlWIa|{a7-0>b11o8u5Ggf-5KuRav4Y*vV=vXTT zs=JxES6Ykg4@#VnnHBEn1-8avysLViqCP9LQ-d+HeKpg6*@{@-lR>DI)F4fzWsO3Sf1C4cv88lusMoG zbQ?{DELodPCzhX=Gz@Otbf+9@vfh&PguK(iKQWZRO;w#bF$Y#?awWcw(dz^D;U@y%#-f#iAgUvZHkkbT_=o(5PGgedvnTw? zQr;Q81(1BIz}jL=)W>fn)Vstfg|?8N>Wn_`<$+$4b0N^^ODy{2_yTzqTJ_{#GBD8B zmfN|T&)3HiyU*JM(oGZO$rGA_+n*2ruO*eReA*Ab-K?*?r*PjtUEQ+4a=k^Wqg_Hn zW`a&Beq?MwKL%jZX%C$OL;{uRmiHTTHrxqq9e>$KhESyVcOX;5EXfmUAVpksCuq8k zwkTyfs&sAX&z!I9OMpv^d)Df}X>9d70(?r=Za;ihHje)lGW{TWRf@lwy1E`A*CjGy z&!PULFOg3G4?DWh_X-T`9feSuVh`*!?&75_uYUHSnX2(avaMygRg*sZ|J%@}H3j14 zA*gb(_Kq>}kV;xxJVa=F!e$G76xEvjZimX?CWSB|j0?&HPZs&UVx*b_gloeQjOvR8@2t?BIB+BD?aV(?oRbMwcB$0+}}A-xGs7QLzP#QOW_(esFw_3?dO zr!!^r3K!snbQ_@emUJ5fz)*$vBc&^V?`CDlxxS9DCdMJO)#vtPhp&Rg(%fNn#J6qH z?&v2T0G7Cq>-$u?#PcWAQt%85qc`W}`#n<~@E-|YE#0H*PtAvK66ov6P1q7~W6O`y z!3oQtd!K3*iZrPw1%$7~x78O8joF;(yEjdXu8~mJ@Qn7lvMS$Q;HP~-_~gSe`GPtX z9*486+Z538J@0RC0Z&~7V6`6a485%f61XxC{Cf7;Qpa56v7jUe#)gByp3n$Qh4HLP zYx-w{4G~kl*;uz6HI@P0jL4p9L-sol_tTjH5*zXzVn%rpapr!19D_tzbe2f4C$ zd=&5SvsD?7Xc??QVA~N4gjWJ}oqaF&lP3pi5X5arKhZC%&D^T4j+=>%30XN=)^%Ct z{lAb8ASVbMih=F3ETzKnU}||VhoUS^GEG3WnI`lhn9Dh-nU9{P*4*;vcp5!oloYj}z3B=DELx*nt`Vn?;-hmKyf4t+BZYCYwhDn?c z7B`RRjFVxH9kM2QlPsjK#rVZ+t8YS(?bk_Uv(Nn z&6gjuh4C2hgRBDC#GF%&DI}%Wx`t`0L)J1?%rL0iWF^;`USS2w?rO#B{$&3%b_0v$ zP!lXmrg*c7bWsGj6ibEH=SExMm7WWlJaphkgqw@hI9$;%61jHLu0G#FE_u)oL%KH0 zN!sc>uf#ttbLPSPZ9EbvZ`3SGM5Y_J#JiV2nTfRJh?+;8R_B8!GM}~5{YOEHccH*W zmT-`qGl0J$DF)zPzw>= z&Z|;jC+sYmfuVXB^{`}hDOR(pgc*QBpDLyKlgGIp2DS4)qLTzFT;=3%>4GdXW-?RH zf6d}KoI|Hqfx8uoo^JVJS(BaV*4Yu7>anTK&c#XzkgmxIjGB1El1#H0CWg2DAA^Tv z6{?3)_Pga8r=^;@kGSmmD!!n@Iu`>g`90mTD4UX^sC_x9FSI?#X!3zBc6wz$NqKLD z!CU$&1NvR4Ahjw4oBML%pN=F~2PqHaJa=ylEnn#!$he*)_><*{H6RiI@C1+SglNR) z2T+^DR$}@4-pp-!zV0Ur6q>mnxGep`w3&BY5JNmV7WP>8sO*WaZ<$@fnN+={$~`lD zBp*D~qn>;r6ipt37VX!>iKi{&{en|WJasvfgXzO~s$8v?iC=cK%KXk4rNjquaiOcz zvGAG<#0`fo-;J8m4|>d=(@H9`a}Xf`M||e%!^UD8j^7V@#PP_&?3eJ#XW_CPC#>zV zs$;EiyJmKBZf?5zkNZDj*yu4KShGi?NHM^?G+D=xm(E26AA9#y{m`Y=(!*?c7bn`$ zVX_8uBmLpkwOAyBIu5V&%%Gj-yhc=A4I)OSzP`OJFKojd+;`&rI8eO_h6ZA(-&($Z z+RrAY#}5=$cG4ht*Z~(;CHpcK@(ST&ke$^o4mdwHF*R8?cul??X+<5uVDffBfGG;A zn^=s$j@>}i2)gVcM%!TojxPUTmM^FMz9s9$;&BSkFhtqk1BRfwKp+gtlf-^?vAV=y zBxhAtuR*T$V0o+9QRi6S4ax#b%DDAsJ0mMG#LA0-VLW`Fqi;`f*Id!j+OA^7XD9z}0NF9o>zk>JQta(&;@u%S7hGRLc{RXq7GG7D(Sd=03heGnp0KH>{(^`F^ z(QBizp!neBBd8g-B3VCiZ>n}oN7@_g-&i9*{frsu%+WuJYI>(x*_9g3cD`nUKu-EH z;=P!<)`CEh&{7y^sDF_7i)6(AK|<0K0LJ|{k`m`Gx?}?GvD8J>u=HJTpUz@ppgHoF;amMLq$f&?FTNoJ)7 z+yL*rv@`rbqF2y+us^t4$n4>JxyV&B~$OqT-nDM(rCVO8%o9gmz-ht*~^)w9`|EQ z^%quFeU-k-f=Vz*d~zCz+K9u1a+q|E2&Oe)CYq9A>vl*o!ImTutd&9?z@kH$7JQ2e zhV);!+KObbQSxyT&fi)ycZc|^ZjVCK{+}lDXpi)*!2jOq)3yRZ}X&U;Iw6X$t0b+2xi=@YC8XV&dle> ztqu<)G>Vnq#^;=1Y#{US9!IX~tzR&c%wyFk9XO{qDi^aIIBRN;x@9GcZn$M()+iZ~ zc)L-R-EkJp4__?)4_WwK{KbFGEV!os*;T%xz7JnK3Xl!_w>U44QM0i10OFXve$}tl zBIRSETXJO#6SeXifAYR)MJ*R$hRz&<3S7y#*tsA zV$qLapRP5xqH8@9pG%B#5R6ML+zjJCyYVH>W8ICUt-h#P$U`JKbxJ7hv|HC~T|z|jYDs}Fm{F^w|@ z=b6W+6eA(!d?>C){h0%lT7~I1ff^Y&$Ul2@Yv*nbcF865tP5;=ORO}R*^!DYM-r5& zZ#7>WtnzO0lJ<8RUPZ-VHD}g~$P+S(p$@Jqm2svc$OZ73YUHPH`YRU{uKauM!8V=E zB+T%r15i|jWO8@}VD(R~D{$6wqx3O{-$@?s_bzUCk%vc}E9_yt*CnSIAo6^4lwu{L zCu;?qNk)NCShI|QTiMDir|_4+z6RZ+myjCovNLNnC*wqmH%f6P;yGlz+1+FH#mQ>f z6O!QEuAFbXw|F3h;v#ycnCMU?BW5Q@X825iBq5|}^p`Oj`{OWc>2qsy==gQDpYKo# zs(8_`#IE{Bh&p3=p7iDQHtem0Og+o zb5<>C80kROl@!_;gt(Q%DQ{ev>hxR`d!{*#R^=h9_a|}S+RYB!rxO=QziWvd;4QzY z)EC-1R$Q2j@@88b&e{$Zx#tMfdVOAtROtN-KMMsoiLO=#f7?+js~os34dO2+)>RY@ zS0rPUXof$PzJObE!$AD==H4ubN0oEIJ9D$Tx_hvL3Qi|6blbHHApk17)xs{#>+h{Rb$sxQFSaz-Uk(-=n z4p2TOd4V`uUED|M&Av zq%oPI-~gLQsCkktr+Hv#bOnY7m0p(S4W3Z$jhh^?gW5QQ@(ik4`+*_3y9f<>S-?@s z`k3yYMVy=W0|3RPmY9~tr6G1=CBX~5>Wv5p^0`h*=7t! znSLB@i=sjB6|dhdhPuE^?ucrPQjBAIA{syL#l*?#<_2!FX%}>>FcuWYf|CqPu?@X3 ztC1q1iajoCGWcA~VjsNYDy2pN-y65%bT!C4p6EEhC#T<~IX)smf1A`-p*a(rq=ICw zTvSFWArc>3Dj_>5Kyn*50Jg{mtw`g!!|A+Y|E9e~wI_Yy_v=`hXcJSbX`A+kp0)hw zhCJ4FOMo%*9*Y#Nl@{t=KCcI&Haj14NrrZBNW6NWO<1x4Uc|TVXE;AIqaMXL`Ej`C z^^=Ctw$KK>vQ07hZBwh$phV!5gf}Lg4wzt?TRT}yDw7U)_G2~=lgbQi$;_nZo9_3N zO?#7+m#|Iyb2adhQX{+5^J)KjJOz<+>g)uc#Eq7=02bmm?++N(jY9eXI9*bhj9G03gd}rCk>KEls&daSRg8i#Nt@k4#5I zULWEdU-C*-z>7xtP^c~w)I*9-TcV7%?&Og#QyHsnf#ST^He%+F3762W-Yyq0Tsj&R zo+;%UBPY@=K(LW-I)1L7w3H>fcfE&PDz&#f4RwcX$dJw9sO~$L#;2zeR`&Ys0z;JY z8Ut`GC(YE6K*L!TBXRc*9oc4QMDvLFG8{u5PW+}EoQ)2teFZL6PSW5Iy7d9HR)q_K z@9ef7O(QeK&yQy|P3PI(g<;eH~J$NL8LhF4e#V@$nLsy8;w#6b99M5&KO zxMIfmL)hUxH_ELYeAg%^nqFr_{5WJ+VP+Q7XStH~=s_Hf{h>>rrGT*NlhC#w%VTHK z*O#+IWXv>3l6AMo+e9%?zpy`JU5150;_`@(=g%rrik}%DUR_vK5osYQR(08eLPIJa z3*+F-EnG*%5&X$>vNeW3#d;8pvdyi1-}M)(bU0aFN{v2UM{DraUB7G131DSr{@+Pk zSI33Xy}L_$p~VihjT4X|UVJ1mF^|5%`pH#cKpTL+1prNv_HC`;(`MlxErw1~1 zB)FX9@j~UAqj_a6O=YU;il)u3_zR&V3Ih2YE`~kf5D9BJ@!8W07Ah3H_=wA_;6djw zZS3UCDzq%o?gViriwG6~`!1#@S(LMu!c!5A(EzlHO4^jY;n;Xi=V9UMQ@VFDzan1on)iAL6hHpn$?>TX|IGB?_ z_7J(+D*wJcXMPfT;Y``*8`H8*Fr6}sPzj)jkYbqjlL(iSj#r#!xW@rvQT~l;Ef+Qx zmi@4#sny`HsJ8m(YN%9!wbkHGcGPO2?B{*i9~nvyN^8Zr4CO~s6mMh2IkHBx|1;~7 z5Sf`f#?F`IJqwZ$vHcI-nRmBP`%mYQ^c$Vj=&$134fR0CV*q2>DV|9GhD@|FDazOJ zAS@}$uX_#C`ebeTf02unA9c|!??+tBkJlo`JsXcP{cONMGwzAtY2PiHcb6U!t=rjT zna!|ERSkAbz;|OXh@tG%*_F@<(gU>c5^%aAX2rgEnAp@Dcb$47p(FH>bO`$^D@bpx zah7*ndZp)eEy^BdyF#W5QPpp8-CC!~EKS zkx0RcmBC5Dh6j6<5vtoe;;KglT1^f0X_eqy7{QLke63&;W@CvTu)qc$ues2R$@~p$ zKI^K4OGmlA+!Yw2L5r5$P^F4>cRuW2EpoEnw7JoBtJJrJ@Sw%^2o1+cCzo-}1WgoW zhAZRt-pWFg6!Zs(h)L1ixdEA9Q1}LPYsTu-g}F%zn8Hc3#1=~ro>@i;4hi3l4?+$Z z$)hXYcsu)^#H4aAV)gfu`I}-5g#|~(=NL02+%g`cGML!9!~d~l2O59?kbgy7r_E8_ zx=W5s7B5%qN=zl0ke&|-cOfUQEf$7(#4+}Sc`zu@Sw6D-!fxhUJt@gy9(nWs*`$`H zj0$(9mZJT6QvAPD%|X^z((|L=RP%pu%DjA9Y0CdE)l{JCGKP^^jQB66-+yBUPlWXU z0ZgJ`MHJ}RzSZx55o`d`#qV?d=tXQm?E8YP2@P>gJy{VMS+aSV&z=mEcKTh6kq)bIfx*E~RbR9MIb^R-`W{ zO~z$r-p!G7k(?YX?R{;euA4`=F9T)$(1jLyZqU=aaUAU!YwB!(qEV$DeoJjFt5JXG zE0Tr4P=3(dO(OYzu!Z-qXVO?KK{LJ>LC|Nd^&V9l=tBwoyU>c15#B%FSQelQcr}=b zl6sxmKv`QTw1YD!y3<4@S{_K>+PWz8AyFK<7~GTR$I=s zAzAh98Rua$21e@HY65}f_11++=Xbino$s^XE4ZFdRwVu(Fs3sTTL!0IB|ElCX>;{leH)*E@6LAk~AK#vn_KepJ6#Vf=3u}P-n83jNf4o5c^R;rhVE7+!qy?$HHhov# z!^GsC^LLe9_bXjibCU7-dyW&*&^-@3W_$cRxxsjTrb9tSMn>C6Oosnz z*smNP-wTLiBAv6v$4US0a!fp>*BytL(q2EZO25B@G$$W6YoOvcIo1DT@~AsiK-HQK z?&zi6k7btdgKB9BWqsss*(H3#eDPRV7?V7ZpQ{f>lnN7zevy6?cOLnC-_SEL*vZS< zGPiYkw5iq0p?&spd`!Aj^=Z=LxfR&xt&0MYg!xJOKqYlg{oEjhj{q5$&=ecX=Kyf% zKr$>+EN-f6e22s;f@Mte(Xc7k9k8{7TciI2l5G%Cd{DWgRga+|gk~3&qeWMo_c50K zt_FwQnu$UWavH@h0J+NeSbgc*JkVY`VAB9|bqRe9W)_18l!0G*`6mVEYD(AsD1p{& zNv8h_aBz#SQ8%n?PVLS2kO2WzISun`Dwp#9^7ioH?6$JHQ7|et8J}#$(PYkuEgt-3 z=2X@0lbu!8V_0H_{S1SQXNUc4DKbG9D9nD|vtE?sps>W#Pl4v3&@A&&@SyPJe|n(# z31znbImm(Ut+Jna*NxHtZ&t&sJS<`R!rhly;?i-ud=;;kmavVFA@rZ?Z$$mf$H;_i z`+27S8QZ$975#1n!*!0Q1IkfvP~RapyK>qCRC`SOb^t#-Lwz@3pIhD@zIPTxBa_A+ z3|fKQ4@V`rGo0SQSiyD+(6q;G3IlV@0lMJPBH&x6esBm09Q)%vg$4t)AA2>`o~f}1 z0`=i6?w2|54&)~606R=_Bi1c!){M9@aq58Qak)Ao1Kc_1E^8PaPaIc)1Kw;uSk4Sw z1E=6Z$dNUeJONOjbh}dWBaiW*8M)l^tv-U=4iCytoVXYeBDity6UsP z0thqvJiz*tFCv27Vt9z|>RHgSuMga1y;p6RF|B4-nNs<^UZv|fKg8Ho`lMG28qiKn zPsN`0#-WpE7-5|~s^BdDmU0|qCJ^CDe9qo)M6j97sJF2-bh<9X%XsiOt!;Z_C$8kX?YtunPQSb>VIe*Vdazg{}R=A=1^YWypVb@By?z zP=6V0SBnSSan~6YLca-R)2W$Iiqq!UXa2pahohV%K(E0e{1Ht3Fy{;6xt_k+#_J^E z2n-tk!T&x)WxQbs@Tf@XDkEXf-DZH_P(2p$;>1)JQCmqJWEm!DG;*rj5PK{V{#;@f zDVfla^X`El-|@%v{xAu_l>=$S3W1Sk7ee0N8m6A74?v!S7bFcSlrQNYqIl2BX^iAo zZ91WO-px%YCvUf?SR%#JU=QAL&hZ|sqeI*PDcr5$riE}v8TK+~gfwf_V_L$J%5-{) z3Vdo9pUZxrOq8J@A6Q~jigWEo&m^B4@4Xh%KSYCP=^~b0=}hoGgUA2-{L*x4(1^Y} zdBAM!VGj^1>tFJCAO!qSPfZ@{f8q$4Sm30hiYst z#006bIxg{2tQkiYlJzE}@(&Yk)*$Z9pr4olP(D?j*(}Hx8r}yUz``wv6)4`;(xyjA!yvmOfX zqC2dx9q~{6vBg1T%(Og9P`5wWtNM1BdZ(PZ%GN%w*M zjSdb4WgdlBDW98-1wIuk1B*Y8j%mwTz6`)x5$P0`I!2a^z}{qdZcpj#PoW7L4yI{* z*$kW^kgz99VBrrLl~IN0uER5oEY~(wo?}mVk>Hy9kxG3IDX!TDNh_Myr}T+VidOYn zBt}hRs${`Uv*IBq9Sd*E#+;@&D(ysd!WBi=;+1=E?s1HQA++0cBbe?7{{qKvoDXMW z-VpXSW{*H3YW6N1jucMzN5pg;eTq8&^ze@JC;$S;2lJ4)vvjtH>x-pa5MmseODg0q zgAf3K)G*-%GO;~{PZr&fJ|a=EV!>(@wQ@Dj%1n zjm|&mX!FK>Yrr>!Ip~_i4@>eXq^j9W$rI!6U}yyNFe)z>SJEjP z&w1GntL@lyn}?*Vq+$E`m{}Ylm_RLwqDbP5MOqk$;NZ(+hBX z&7(86@HM5nDIjMFU{A^2UKKFCm!XVLRD9nfX%CnW!yC)*4N>QlhbygrzH%UX^b_<3 z4p;PhTr>29Am1ERDwuZa?x@xk>Oot*)U^RxG(M#>V1a6agDed-R}B=94aKyWxoV#? zuW(`lSCtlom0{ZVI{0AEm6#xA`4boF`Od|YRic5OBFds{Ga<|(FsUloXyqAEcjYz4 zUfsMS)`bI$GQ*pd3URK%^p$~8`rf0c=5?oylrb{{nRZuDAHMPB!Vk|K7V}xKUaCYb zS*>#V3_W2`vCL+oF{qotL4^%ue24q=@+k?yL%I@L3ciSmXP0OVLcAdsE{2mGgFKh! z4U3(i$uE^UB}R(MTL<~Q!;s71lZaGC9-XfHbz3KtTL5ht=*}!zAx|}#OU2Ukop;7_ z?PoY86bAs0l0eWyGlVo07Ql6s=N=9CT4SMV{?DklKe(pwBYKBQYt;$q-%$^)wU*cA4?QlYnhI65-eJ|YveH%nG3Qh4`$Vm@16=E`coFGV zP@~K!=vF#vf*K=qB(rs$+w{FE-hm+dC+$9SK*>8GAPGSq!lp zM5(yRdMhDPj*KZJO};?OW#MdVmT=6bwFCQjwGjQEviVo|{n(xMgS)`HOWJ!J@O!kv z$Fh*bZe4m?JkNY&s{4MH)|=gS!SnGJDq~K=Lcp?SCzA!o4g{*uiG4q+d0Cyzm&wI` z5$fVM0T@8DTWL2KcN9MW8wzb#?B_TXbfY^1tWGU*g0p-XK-mma zb24uZgrYY;adh;fKi{ag-(3jMCcvyHpheR?j~$rOrr5)^H+~4^b*@Tt0IVadOjCtS zQ-1_wgZGP2sx}hJwEl?frLE&_JeJbD(j6rAZh9Q-2yNCMG`tSQBgKPM*V9tUeOt87 z1*=O@1fxANX2YU>*X95hvD$lNc!!M*Pp)-2j*un`OX7hnkk9|vXN$4_ZI-3O_uy@k|vX8Evj`v`Mk^d%+9Mt|2{_N6m zoaVnv%#a@xmgg9HmUPRPyh0vnVq_1oCnI$CiC%$+;8IZvf_;T6_Gu_7;-t~rv~_8H zMf`AnzM^x+hJIPKpr%%w&-U#l_+SHJy0K$;N@dw`$5+SQrD_Q@07WJlJUo`Tp*N`Q z+-gA=nfYtWy+U=|3;`7?xYhq7)~YvN(wn#agE@;KjG`Ap>z${Cm(udufeo(7PwlW9PGk`_2I*8-P1b_sa>#r;v@JBgKzd_HOp|; z?A70|8JxfrvL6yk3o1ujKQ6y8=1+h$Jd9l-`SrOpV4eM6biGrQB~81oUAAr8c6FD! zY}>YNSC?(uwr$(CW|>{R>wVX^{=L>7@YijQfh~`Sl(x&&o_J!mpT5 z*E`HC7GO#LB<I>O9t zqdMmr?-}R0@46{FhV>3%6rVxmf3UI}B1~uRF`LhLn=Yf`U^TEJOtzahZHrfU92AMR zwVmw9&N(#5&K0r)ixh!hZL9cEls=odu{xcHa2?MEgSTt=aGZE-B~ zDwO*csDhQdS5N*go87vtky(9>_^rFmT8XB1b3d$GyJFnl^!wv2klWJ>=nArrR-pNi z41t`nhUKJDnMi)gUKCAN&Nb3GH_Por$Pi~P|JP+mHhXnORf?-mJLpAt% zjJ+RRZWA4*2M%JPTkj9?#CVsW0d1I3I&j{nf^FvUS^vY!uDLIuy3T_T){?*5G7&D) zcG$oJ^UxvA<-fj@$sMm}Vxp=5)O-zh?bQy13AQ?AJ2!2ja9b9^%WD?XnyvyMJ3IbA z#JFiV`Qq2+qL-YD+^x#CQtm-cPjTLgUq#|ZEl-)8gQ8VL9*6nUhwor(x2+S%<;MAX zkZmh?;Ktge?B}z8gSxdCSkN~s8}!Y}Hhr_QIntVkC;9w0kC3jTgmTuU>tG1G_mtJb zc3Zhoh^-WXgWqGrzW>Vz)PDE9C*13Aj`_t07plKLdoaN6WmC3t(GtHSEV|U)*bC@1 z=;M}nJK$nRei_KS*A{UXoVC-U)-acx>WGOP+#r9WBNbS#yuw7`SJIg!Q9#noXI|ki z_&w@~1S8E>0r!9QvN-u#x?@xlz^zl9`I7!7a#EiNpCNkvPZ?P0wge7#U+BxV}@({2V<=E~GQa#lo%X!@F;1&+WjMOGv?yOfGs;W||w_M3}dDfq%Euk8`2fCiDh)u4`Xz7hb zmn6Lc;g0UcnXR`!sLZkwVYffbZfgs=doyZ}&ev_d$sOFJ#}S4P50{R(qNQUNgP*1U)B2vpy^$rX zETL@fn3aK7n%>ULEt?BA+lIT?_V8~aF2gM=H;a%lj+KE{N-);a&%+_9_Dp<@2-aAJqAs%^p_tmrDT;36(otBWjWXp~ z{p?E89$D9~7kDPNuxh*#(ss*S?|Ld-1f1vuPd@WIg^go6o6eB91Viae{hj>&7Npw^ zrdnP;dN7J%>w(vit$W4kVNfG*Ves`nVn0=z;Jv#nG=7Hx@@HY1Ia&t51m{&6>yRz+ z%Rn1iPM7mreC5qOq-9OU5H4QVDNvKNjlMY)`kbk5L1yQz6nN9y=p!&!M$!zUd5k%K6p30 zm`ZHs3zfAIe09+IYXJ)9ih>zGaEDM2z8+8Sr&@EcmwUt6X={2XsIaJ0TVu+i#%eLx4oV1rY)RqaUxJ=` zn&#ezYNylDX`ZNHX`)TJKTVGj@c{p7l?1BMEwX^M zo5$eSnv1TwqIFOo&6(CwSkjjQp(zg6P`5TyyGSBjGDJtqYCIv0o}V8dzsDk=^%sB{ zdDL*F(rm(9r7=JZ6fYG?Abpev!s|F|%&*1P_J-SCms9Ihmei_!ZmYABBn>Dte;k)V zNnUm-8!nIVb4XLJ=0+&1S=9)3>Q%C3_$hsKxx2ycq`0lufRC~&YU`N z7q!YT>N+j2zR`un9LX3DTS{?B6ACjeg1qOsR0)A@_MU1>SzW7zjPRSktW_kdm~xf7 z_%wo>&8qugXvJZP7eRdnn3VC*90R8lxj^=Y+Yz0T+`3J_cXs{^4F(VmTm7B$4EZ53 zh^3L>omFB5hQvr7GEEhp>TJsZocn`88QZ-u%&lw*9hu4(lyU9#it>giIb>C5qNW%= zW8{rYX^1Nq>ooB|XymPkZDZu^Xw&J31cIs1CS7WtM8>^EzrFt>J|)k$rZh7D@0t4lo{;lFk|$OjFn)K_6n@`z zWY->L!evLjW9{Bo>GyE6LYYNa<b)n zguB#_AJ|k)s4^UjN6)0Gsdg-jojiRO>DEpy;}s|xmQi*Znwa%snaYV2%SR^M63lK2 zd^j5Mffj%=01QWPyPAw`*JxLw#!jPGJl$wOW1w{jZ!@~MNd}=dwt{r&Nd`qkJ_g(( z&Wf@`)tp~V&MkkdsQSl5V9!={kP(={$%H9|-HBQ@=R=S2s^L%H%7U%u;i6R(D*HEf z9TxIlQ}4c8G2dx{yS#g=l9#Y#y++?>QGa%jDr9{(>OL5F3ExfZo5Y*_?}~0I@v8Cq zkwSv%pjPZrxC05%0NY?U(ym2b(ypIL0EEAUVUb$r_gj%QzS{dT&+Fg(g+71JHwgtzA~>Ef}LPR)BamQz|W^d?=kBuSj?+5LIV%T zDL%0Hij)C_585Db2wa_YqpiSlY67!=AAWwdt~n;A>0XXR0Jpem5@m46YAFKdQffYue^}Sr z;sxl&A%ND8+T=rNh51}ck!WGlqI0keW+nWp>N^XdoQMKf$eVqkhgt@|wsw2>e!mFriWXdT9{P-1M)vuh$BgLXNU#DxjYa-eB z1AM&V2LED27q>Rm0Tx}wKo=ZFYU>SmiQ^`_uAFqmTH;5 ztW`h+8)y8<^3sx?2Gk{f(B!I#m?D;7$$2NO-!OCBO*;l(XCMhz?9avtEA)PnvaS{d zP-(iHGQXgURHu0S)<0sY zrVD2oe$(^pL1@gq4WXXK)o~1Ip6xF{7smwUsn|>{1ShnWRy-!iZxSjC@%=TyxxIQ^ z4sg7kW^xJ^IW+Jj<8UqgeK}lZqf*^Flrj|HTpw*x(gBq22LyLo6ne#)(s7Lkn^+|w zM>*%p+Ick<^@t0FKV9dnfI+jkmoCuH=3v4}sFLjqxJl*ho za-H{yp)wxqE#eC>WZmZekZ4zxAOJOM^W0FvuI##;rPIzo)O_y_iTz?1HVd z+Vl@*7hP`ExICQJAqi|Hts}R!WCEhz;|&xk0fl6Re5yQ22F3&pER=|}=T;z-h(x5c z{cnde((BzC8Q3dGq5%p>S};&?J_|Ik>+Jt!4#-eJ(00*xq(%V9$M8(^F9k&rJ+=J) zT7?lkobxZes*ZhZ^Dh+dUs@48y`A;Ihn6$C@W_}%rb{hkx{@7H1zz)AFMn;&MUFBk zz|0X}mn0s+50B^CBJ0+6h@S3p7z0X(v?*#guRU$(GuA;2I3KAHqv}UiEe3HFY5k;R( zFkYu0^}O!>lj@l9vk1Ke$WbegKcME04C1snXK4!97+ro;2{zO7qv8rISD6N#yFJJ@Dr|gm7?D$m5kf^-BMFL%W zY=(h-9FPIYd>>o$xcSdOVtI7?KQmD0IO26KIGVlA{~ouZ`4%@8O_`^JS1ArJf1=W| zj7v|3@tVI0vmlX!xu9;C2z9dD^mJ#xeI%&mL0?OTx%Rt;K89WB9;lM&t-&H|Inz-@ z2X?(9A{{Nak|Lzgx7glT+BL>eN>iIk8A=X&{Rv$0i0iVY&x`02=8x|ZLOJ>w6$Mg1 z)bFpv<_Qeenj}X@dGH%t5_q2ZMRoMu?I(=QN*WbkkO?QhJ|xXf-4z;?75kI>MSa05 ztGVi<49n$Ouj>y;gCl7{6jT(Y60~h@3HN}ezzYli647EH>U*`Uw=u(mOMQjLlKhNE zIs^k#+7Nr6;&>V9!PGdeC>}~bVU@gnV&u-MHtq-IQFezh%VO+$tjkiVS$Ta5^`Lk z#l+ZDgZo8bD*WTXSGJOSQ@H3%Z!s(=h&T^RGF-!3tc3UO9m+$lD`C}l2{0S(E2paT zC2rsO*n41#9eWs>77Xc#%kZIdvb(|$J8GYtf2ey}hB*028%h-J!v=!}f9)$+It+jC zkw`@0NAk)*W%a!N*JQtnwEA(YHzw=to@>{jtu7wax4gS_CC1P4v#YnpLqdODR%f|w zWZImKYKzO98Zi>$*XQQaR|w(s+We>Rl^O4Zm)9!6Y~fzx;f^WqAtTl-K;nK|CYDlq zHtsquM@p?F`$=r{Za?Bl&LA&BwBYd8Zd74UquenC;WRs6o$kPT6~G2F@5`WPcLN>S zExd@QrIR&F5{pj9$6TE_uaMy?$8YM0uC0=!#-9fohd^q@Xu*IO*!*mCb<`6*!t=d1 zh2_u=N5S@?IUASKqEKUTA2lTXJ;fzO-8Q`=Rl3QXV%@x8TB+Y2K~6E0c|nzRK{Iwk z`hz=MEiIRpIgCzFehg`ZH!b&^n?$BPMUW?B7CuI3C9Q0%&6eKvDZ!vq!EzPWG zfbeo{$G|p3fr;n7K(eo`6(AG{{kR8Ju3D00qP%TxBM7B%jljPT58mg9L zoD`eE=pC9=%I4A9Y>*<*NI*Q&XDncnB$2z(KS%TnUiEJnFIT^u0}^qBn}aTotuvTY zdJs~+*B-K(%HOKcF^AeNm(z&F^)6#LVNZa=@!IS*5E@5DfKANt!Yav2#d%NQcl!I% z@n1=5y#>g=bzCnOj0FIS=iwhJYMi~E9PesZo^`~3zt=0KHdCi#(l%@1=sp=KZ`oP& z&5Onq;IM9%}%Q?}6&E{mXndcJC>$cJaH8_h;G{C-6Gzrpw1+dGMFD;`Y z%Va9tc^A?UpdKaBwTlIfR1zInHZG{Qb#~QL*9Li${_2Oang5Xqkzz}^E!HmHh&Z1_ zhD1Mdw`fm3E`W3kO5)&Lg!w6GD->mfwg=(Q0V7|Td>hc1b?}eW8Pr470kXOQ-#X38 zyh6vO0{tc_{n}A+rsD|SQ9^la)&6S8cbp9VO-p5A(L-~SaX8H%LG~^*7@o(DVP-Rq zCKYG23l7Sp$;j=69P3K-jI>jB`V~dn)EgS>=`AVCmMOhN)Vs4rp(EsCVAKI#G<9Eup0${9e$BnmCo2N1{wu zECitP{31jYV|=#CcmNHz?)85S*$$YC7ChtN+s2LFxjsbG$^Y2MqJBsa0g|GaDgzJ{ z!M~Yklk}Lng;Z&1lRGK{|1H=u=YGmI&j}pL1vMDZE7QS5(+*>9U5^@{^Z0d|x>HRXV0blPmyeZ51`H>4bZ&wp}8r*JKy8*qo#dDt+ic`XW|RE=wN3Ff9Z4-Q@Q zw^PdW=Kg6x342%o*lMG~!VDRBj*bj;P+($!(QA$zNL6$X5(pp^-L!6+ekrk0o$YE$ ziAq?fN{{}p!<&^d3*pU`v9I`{isX0~eibiBvQ_ocW8ilX{Go-o-yQT+NAuo z*XC_}kflk57N`*=#Jrn*2N6Mz%)9}abEvCF0WjwqW?^xxU8SbXPw7V`S(Rtiw8GLCJA!Ah)uMn*r(j%e(_Ck(7M?ou`gCsd;B97$7TO>}T&G-fc;$dbZJxJp zQqc!tafQ;bQQ>ii_agGCTmIDjc;L+cfPN|q?9*PO-=90S|HGSU@Fk9#!i+u5%ZD<> zA6?UA6ev$u&v|7Em1jmxR#!c?yrZ+A3Q`rrZ^Frh{;xtwBkUiA(!rq=4jsq0GTf{s zQtBpOOR={j#1-@Zu_ir__)Zead3Vk`&f%;&UDvPLZt6B}r@vPF`YqTw)tB%fH|5eG zH&y9m5L&N$$5eANFulg^SDHR?#-2uhn>SWsa7r6IyAab{>8ofg3tbwKF? zGiXfBXy)sDJiD#+D^cHVQtDRc+k@l;hDTIYMX@jTgcbvMoETjEPJRPVRmN)C-YDS| ze7F(S)K*vI=ZTnh>6}S}oFGA~^a$#D{xNe=ikkt2cUhkC!5rT?HyP#+z!eC3ghL!u za=Y{Q1Y!Q`K5|*pd;Vm%a6{~NEww=Gk{!HhORVQNf9h;GY}VY#TfE>xfUYU_oPR#O zQQFS!RCyUKZTo3Q?fjH;QS|&@nR=Gk4L_|dX-g$0khcG{oQATQZ{<`|-fAgPFIhBUe z?b7Vm&JZKc>om}zgld*iu8)j>BIP;yM!G2)PGZ_nDQ+*l>Dgb2 znItDPMr^kAw>t?ePUv@V$}6PZE4?MvepV{pax<~=K$72}AV6+ZfC3V*e@EJ(yrhVX zU*kXF=0sQ#B(r_#Qg)6_7jvS>2F7H3J6LX)eQ1!qtuZcciEn;a}kh2x6eyp4^2~Z#Y=Ij)7ti%WbF6W*~P(Rx^(#F7}=iA&ku>y z#@9USzo(^UqgN}NJU(RGe>Z9De?|jFz@I3Thk-|AJ<8MSm{B=W{@L-2%Au+~795={ z>J|A=1&ymUSeYxdrcMGC>5tM5_Nxxll}IR|VSnw351B{QO_1{bV5{|@D(Pb(9v8P0 zM-F_nbgioBD%{QKH|P8>qN~2D>wlCsKmSqM7`6S``T0YsgMWq%ef7onJ@tLoZ^KX2 zKqDu-Sy7CPFp#vPm@(dps$L{PK`0A<(Y;*lE+2$ayWewDN^;95MlopOW;{~u@E?`U zCijyi#y={X?x9OAOk@V!#}+<;X(?TDVCvcMNWrj007RT*AfgHBG^j$xuAY}b^J73N ze5a(NFvo4csx~MvEr`y{bB+d6F*es4c%Fs*-_EBfXm5D~{46F*iP_E1$@7;99qY5F z=1zCU_)UJG8JR9%|9zP*R-mB@?`K9YNWYz0MyhEiG|Ky@eyXtWOGv-3KaHA=DHLIU z$T(26)XMfJ{*nXZhzGiT&Zo=1d?Bv}FL1K>|GfS4#9a>pB=tjI@9g$V@8vHIEMRsQ zwNk>|?r-VHtX23!V6`U3M|vQj^kjBrcis`hret^3@sgcm$?9|JSl;9bRc?%svm$)O ze8li+MDuN|+-blHgDKVeL@T`wqnAgt#Su^ONx;}a9@OO@iH*yN7w}K> z*T}Xq^y01Y4G1Ibfy~|irLb}PR@g++&S)=vb%kZKvceVgH2&s9{CQF+vpj0gdiy>8AsA6`h#Hj^cM zB#wL`w3>&4d|M-gJr-?gnP~|gYr+zQlU4wvx^$aPe<4urXZ(kte2*yXii4qno++*z z?dyAi9a2XKQ7>lCuOu6h!Yj&YkJUSz^wq$3`i4;-)BARH@0{B<2lvt^cWJ=cih5p- zUgCQEgi&Y@K2viwZ{V4G^bi`o9l;Cq06PySeJKP-bn#_@`R<3FJszO*oS|7@Sl+T2AW~^UkNaoG=$N~gWt#S>l8oB_2IU-Csp^ z{XbXNK`&ta7Nwcx6*1Wsh0oWfHur{?H&gz%f5ufKYg@=Md`f+bUs!yAjJ61B+$gfD zL61jEd_irbUYq8(i|c3#l@`;LiEU4ua`XW5GPaGWdOT->-#G1a(g@J)RY%biVMSqf z8GwHm-Zaa2zi)ysXsj{oAwK;qt45V$g zxS_#hC^j(3CfOtgK8M~5=%nY#@xssb6{qSrg6QO(e?)2e$xCCUH2%+Fe60TDQ(y&V zGO^csx4i#VL?r0z0ow`Nz+~d7M0HkGoPjJkIQaO^+#haCw|;zrS+tywWji@xWkXF75YaVt0q6wcNdmI}v(>#|RZbK<*&Nl(nI1L>M~c zO73)wnOP+wtj!cR4NkXHdZJi9dEF#;FWbSohQp?X#Fc1nVX`-)RF&t2?1=oi{JtRy zg;fYjIf`b|ZM3#d)X(u&yBY%`bzz?$?JNOvQ7=AiWT6VWY}OK^$(HTsiXNt0)rpJo zkS5m+o+4+UB2@ncgkps+jCbDfzUQ0pLjA^fk{{Y;2KwD471}=-NQ!26vxLubx8TN? za>oDyBAO)KfeRg&rEFlk5 zI*ss6QM13=1SruhPslhB>xiog8k{KAEADp__x|9u1mzP8X+ub+&q6@-%tbQ(GV~{F zM#x3Zc^65Xc{abe?_xKl^AVccqOte#D))7%;Fu5--1+=qP!e5%=k%sg)W&mKpaI$ zf(UYqEHgo~g!6TJ<=JuC*sHPi@38LGk62y(zhdfcv7jKO(nRUT@yiM;I>|r>d&v9W zzq@uwCB_V(e6lsH`fL~dACUoa4Hm#j&tO8?U&j;K3T!(h;0=c!y)|g!k0|+q#1$p< zz!|6^+{J0czmUv}$sf(DN`|kyDRngSab7E;ek^CgBCEyz_E@-3L13*_+01|d4Vlo( z>9N6YA4h-71JLMwm;K4~?1DY9@UQlSM*twguTA(@!~Jte1J+uHuufKNAX&2(1S4UTB z*h4G&Q>|m(45g=PwfyQ#ZiVB#8&_dcId{Bm^_`{V3z`xv`{06YY&zLjx#`rFYZsV? zh(rl}Qm#ZcX`RbFShI7GcnTm$x@6(>%3Z*xK0N>w>s&cq3{2k>v^<55!5AYuqcx3t zAw)lgY_UU-D|wqT{WglP)yt@Z9oDpsK<{kF*6Q8MZe+BL2&Z8Hiz0opj9FrrIeAH{ zd?r<&iKL5N{sBGsmU<_pW6Y-7shFXl$iu-zlqw-K(KY8kHEgaa(R`c+t29#}B|Rd9 zqO$pWw{09wE$pyvE|I;<>K1FK|NX~^KS-%IrMAA-&A}QSD}&nH8?nuU;{&6e{5^h9 z(G}N`XrRhQsTbntJiU%`Fg$kLX4M_#*YPXri)u^V%ZdeVeRRm50(}Eam^r)g6<8}g zaVwPVf%-JUve86dmYNsBt+pM^5_y(_(FC$%`6-*?z@jJ}{1i05n|w1yAM}&;D;x9s zch+rV7@Wj5e|QxV0Mbvo5(;A?s)Tbk>&Wsbvm-WOVaPyJ9A5 zWE0`}LmftSj^1%F!%-%2oI~M&C%mUk0XV4f<-^gvPl%WZ^YhucAm?JxV}e`E8Z<)~ zAr%8&Jr}|L6^kmgubNVZcq9J5ON!c#*_NIQga(pJbG!&6(bZQ-tYJ;qnV(hFt0oz(XpOpJP9 zo;C3vjJ9((_8#;jpJeOV54jrQ+h|~hZuYf#oYyLC}Zyep1#5ET+Q1d zttLrdlb-!QO^DHUZFlgTJ^KOw9=nGBo%=o91&`xMke(a;1TSn^ie&@6f+QCpPtLwh z@Oqy`fH`xGJzEUtr#Q_$YLeFE=W?83pC9KHm4F8IrU}r{p;OL2l5xfkhV3D(a_%>i zudsV{F#Q#{=P9Xg#?qx$!o$U-2~YuYM?xN%-|Bc)TNL~iv(KAxrm?Kx`++2vbgv$b zA;^%eLKB}GbKIXr=OUauOKz4DF%ukey#)XBwlL&TI{j!!6jkz2D~*6N{{*!QJmN?1 ziA2Y-#EwYor&sAG?}4KN9#ZOklFh4~l#yb&+r{Gv!@{I_zT+j}Fx0v`1l8y8@CSTd zHZGDDy7lEC@Ps`QB`e5CA7|AJ!|e>ad3VFsQ3yhDSDCV>%DeKmPY9ehc*Y5L2pEup zVllAO_F1aCl};!jjMY4*k~$(q9es~^QN3h}&yeWVtr_Z9UJ`KvD!L7*&?dS}g=pJhjOavbyHu$s2IP{$>;;boBI73Jzg zNWK!kYbE5pQ)YfLWgZAoNgx^QFB`00M&1zWNy&TZx{nx+f3vv zhXlk~ph=Xj_<64=tw1zZASV3kZN%Ncu=pS%NtGao<+y+HtT5(P3F+jpzLI)jv=hbd z2``0T(zn@RnMAtw+kUiqaT%e>myx#=ye_~CHe*nu@lQYkS4if#M&&a`WfQXX8Nmc4 z_s`&7d7EUI{KC2FQp|;S-O)eAO#9K}d({Q~^e~C=GzdNJ?6Nb%AbZKsM(r!8=va_) zeqY$!wlrL>($B6=y-3aXHB9_`@Z;&YG&u;v;#V>$Z3b?7ES6&6q@`(VUn_KPvKkH} z2X`irs0#?z9}=63Veao|U5v!W5Ko0!$RC#a7&Z;nvk8cP{|eD^SNDQb6sPfE1r~#( zvtuQwLN@i%?QxD$Aj}XYpg051I1GcnV)XP{gHI9t*F8!Q;izQg&!a8Nq9X*zJoBw& zU@>VZ-+anqP+*Iz+%1iM_G@PWV3BL+WSWpT@DPT6mB>eKf_76BZ&S~#BB~Zajbyr1A16U9UqZHF$j8JY>Q zBX!MUo zXlOFOGJnb$%*VS-%=nsux%gA6eF4+bl7-CPL6oiRc#M`+6rWGgo4Rt!t1|V z8GTI!>q0_o5e(ey0Twd)8=q@weND4Mrdx96TV4nBn&iC=eNDU;gx>@IorC**nSzPl z?v5mv4mE8BtmJ#zB>@Ljm#nNCbz8s%Op1D1Ub)-mnSr>UiDGI0k7Tv?b3SSDm)t_9 z4x8+0?jE78!0T~p?v_HBrg%Usu9mh6mBf>qC(RPZ&SVg2LCbO=jPY_C&}VSKc1suK0S(3g)xd~l#^+aQ~qt{$X(H||?7DCm?jg}A>f(}$fHAh{_q~8M6V9EJb z(wfbxxn2A?e-uvIN8xUBq|Mq8v>NS*-)yV2Z52~6rKgM~GmgIucz)r~Arb6Q4VI=b=PG6GK7LeSO9UI?vF#nLxS6)}j{En1x!;4rz71Ob?BIvzG=xOmh?T&N z^$rFXI%C7~F$2}LOIq&&(WNiiX${o3w&5WDuJN%>M%l_VGdOGDEOpi}5-kPIXs4IW zf)Fq!#TH9PBSbC)kFuyQ`$ei%5dIV#wI^FDmW3HdE@|_*h2SF2?49(bImczA(ybfL zB5@085I%BdP0u&q{E^P>U8tWu8g;eWfRii5?Y<~lXv87;BT2@Aj$?b$+-WqdK2T6- zyTeU|j7hI@juHQ5rF$}^Gg$^^SrzT^7K8hWN^3j+x0CVdl7resetO3Pe;S72Lk!ie z@)eD|p1yIL3SY;cp_i6Smfva{lP)87<5N{l?XDWBj3%X{hU6dT&Kl5a^e1P0oK`mR z-CJqpwAh;H*~iz;NfuFPrKN27(X= z6hMmbNP_Xh-EOJ(ihY}0h&waj()Jv~VH&$=ovE_epwj?cJFj76bOM`T2G1U7f0PSJ z*e4D>&N|CHI}?kJBLcIa8L3|R) z!MC)oXl8MkuN$d;nBOCy`V$iIDaw(8zVs80!HRgaVc7>y=ucnn!~uQ$j^NwztoP`` z5LBk#n@Sn^4&li2`&`Rv?I@b(nJmSc$VUW`CWuA*SAuy8rM1y{jkVFb4kEEOZR_QR zx@w_|Oc6#wX@UoNtE|g4qh+d~76{Z4HmP}gvxjqoEGS$C&0Gq}?_Ctiq?khh;oAlO z7DuT8si1LUJt;l#p~65`_I`aWd!!Cr@NDs?%%0|rw<|g^9C0^LYQ7Gccn#{*zRbxF zO`T7o{0!^KOntu2yKMT)y%1>JFbs>_GXecKy807nY)2Mi1{>IS(w@ThnaMPO2{?3d zv$xijsnbJ8?jlKyY}M*RpP9>Y`n_UUyJ84KV`boajiB&8FL3-Lh+e;592|S^S}x#kJl*WbH&Kb#Mb4z5|ug7%zEhW3r<`r*|F?zJuG*2aSRm`jWLn29j(U<$H=8@v6bKYMER^3AigDar=XMJZd+N+=sxG#}k zO;fD^%M2G3h;X^R(3okIG2CS$bJEXSsS#q)5o|~Tf~n)N^>VqHn9p_;ZpJ|{359y~ z0_LX~JJz9W78u`vFFx@tTb~2hW4XptPfxEJay1P8la3;ZKr35ZeoTRpSVfe z(eo(RZ3Vkk6QA5l+Gfjfy6K?P4mQLLhUi%bixtEpw`bQE{n%|+9&5MJ^H`*egEvsK zx=sAYcdx0-D^FUMen2}*f899|pBu$lbXWfvp);Oe?P)+L$72@%>@83CzB`j;>~rX! zuZjfy)9<0Oi-PVq(mbsH;8Bq&Nl6}q01%onUU+Mucb!X5N;;bdY8ax#K9B2Z3_Mf#e<+}|j$R06 zNQemg1%{1`eF0KFVJ6`DgRCc#Rv-&vKdH801pXF59;clx?q}lIKM_sWJhAn@%#Q1R zj@}(>`fQAQPtyX?TG9@ts2x5;tct`!Z2cWiuz$y)KS98&ncW6tG0Qq9p&XR7tt15| z@Z|gk-XP(aQdRfAet;JI!sMRWGY8u7pnT|1mi3rO34-e9KCSUhtBPHK zjP^GvTuqX*t=&pTC6j$St;qZf60&iqoc-qwK9xvuZRv$W;@gCM*UvoxDLKQ#fY~sp zdhHsIO~_o#omLG&?N~R|OEoB@$*SzLJ0>SmK-FF^^{bn?>QYyMhFg;hf$ZGkmj|?= z|0w0xCLiEO5M1=z1Ah$^ACCs2FU&liivrUKu#sZI5SKm{WYmSo2ymfmqZ$_<8v+)r z@spE%pL&tIQ-#V}ThJk@)vlx|vpI1lS2KZY`AQeZFSKh|^kRwFVe%lw=$ltxgw->- zi0Gq=p#kpT!nMeHYgjSvW}*Vai1I$)E5eH=%SzZrbxyf8bz!5k;`ul%6Zmjb*16 z7%jQX7WVn25!z4w9q>|@pv+EZs#0aOTDwR85cKAvf}UV84Cmm@vAmc613 zIk9}*J}Bw_bO+T)WA1*C}!ukp!4f)!5 zXX#=HJbLWm94I|c*7!+n>!I;^N*&%0kt{w$V^s$Y%ay;;!7Cf3Bm`9rr7K_r`_&cL zWo4KQ&*|VE#@IH%h)>a7ENzPFnBFxAHtC3iZjY>hR z*Whj}#k*zY?kvbNOQ!^gd8vEH$vu&rVhrZyh2klmyo}52xZHKQ4ObcNQN8}|QQ-RK zY8nd}IcLr*9z{mA{*pdmNkfCHakT=Y23v#KuLj82I@ou!4&)Zj_dJI~+^iB?B+jAM z+gQ;W6(J1HdTC*rbAJrfQZm&alP$b5a=cP^hxylIMBsiJj?S$OZ7H zyA---N_!UMZ_d>U2EHH%S?5RtYy&gR9YG(%Lk-1BgGHT)mJ;`etEZt`Fzve2!XCh0 zbrn*qH5zF#YqxUbnAUn{nV-{Dk&dq@wI$optD(_E4BzCW7zk<{eorGV(GGH!sBvN1 zDai_woWHr;#VltK#V6gFmvQk7(O8u!Q?9PI2_&hn5T$ALjaVx-VuR!ou{6I1w5#AA zlXUI3k25T$n)%g$UQq{#0n~b^A`8+7UJSt|E;90OwGt)LRGcz+YY_lCR#Eu!ClXK6f`{_yVPpNyRx>_2|*6glY zYtH+I_C4hzP_J&c!FdCmAA6E+BwT$xG%J!y3vU2PM9ZGe5> z=Bm6@&v=#6$;hq4IXKPY7&2!(>qUBLh`!KJF)CJ*Z2p4eufQQ+A=5@?oA-ebwF|?% z(!!>v{hmfXpN=L&ZG0fiYgNM8%Q)3)OKG`E*EhH(GM;fI?GdkzMSRU!m_}e9d(=>d zMZ`<2Vzu(gO%=EbH3P!vbMT5baviHj zCH%YqhqV=Q)~uDqRK+V**~5GWec4?T$9L6eZGMnToBANXK%lV=_^4*vHA4ol2WTlf z6pSp{KCsG1W4O0`f92C<=z7k}W4)WBWZP=YUnBx19TvggmN<6Ezmqw8DhBeqV~W3f zC;!W+62mdnhv!+Wwyz5GU{B9sKKZY%DncM3CgTy;lokzEEQcf7`|49#muKzcCjHck zUP8^A;&I;k`4Mwo=eC>J#zS1#6vi^0T_ztnv03m>E;{LoKiPz&L`zp&$!6lYS?0p@ zgr&6fm&Ywlq(zN-Ec{5g@a(eXQgie8bhM1fKmE!B4j$?&A+FcIJ#ot$kesKo@kg0L zDI-l2Xc5a9{-SjXoV=P&{IwZ7(%bgx#-09qlhd_PqgjCW#zBWj&^q>xioV!YlP**V z89DjqyxVtaOmnM0?`Jos?F$VH(Q3-kA`OLeni63sbV51DChAq=D5X3KIBOp19*{^} z4MahB%PoZzZ-5Q&mZsO2<(hcdX6aSi6H@Iw2$+c1?T;t^>v^ZcfmrXy?E&R_gHFi= zu(F$WtE(>*7RqTZnm;&Z(I<jM1y9=jC;CFPyldAWuzm%h#M$U8{j{UTxgphuV^1C_^T1qK@-&V}rn~ zyL8$dn@Ct$9__?RVcqk-$bENK%oyLE5zz^1>s4rX=_5e=&+WkcncuH0muD8y$Lb!FFR}J1LbM5YEoJk@MdC}E^ahK-?3kjq6(}mxy5pa zto=pheA=TnPgH4=^PNU-W(kl**$X_>LsP4e^Bw_hObp>m;G@Xmm^iZ+DI8x+7{%&- zY`1ZNBWh;Pm{jqbrtZYjdGww2oAD`$M5xKE15dxoerCEO<>Jz4I?}Rd_H>@pp0?wC z$PIam3aCj%@)%A9*|r&eqe})GgN?*7*GZ(WDb*lRDbBac-IO?vD`cX(vWi;t&x*_Y z&025jrbF!zOZMM zpq-rPwq4V@l8zb8;)UfnGz9yW&AhoV&Gcid5x~{K{8`qXFcc<;Pf#|Tw%6z)Ezr%Q zzJW$mRZ6_@XP7y$-`&W*)*1gzv6Shk6C(Md{@{@ZEoRFo#rLN}0)tcmi6&W0X%d|Z zKcSFDrHqA2B3Zt7C?nl!(0aon0EW2Z7yeXMC42F=>0~}NctEdzj_Rq&XURe{^>4|7 zf!B~_pV(VRZu9paJ{@ag%@ zrA{C*)r73xfj|^ya(Ur+0(E>%oHKHl>vU%YqaU(1(#F5!aFq z>pa-XLH=?fa)o;-NZv(6G22f9?ely{XQxa35l|?$(p>G90J0zOqIUrJySKLl462SY zeI;+*hgsQGYM5%Rf_XqW+or&|Kx%1=W}Z&f*5UlG=j$_-OEpLH<7!ke3*69<$N*vC zP2dQ@vS;2=nCFwj7PK4^_uhMNR6)Sc!=pSRh%Vx+UwZj`-y7J8V-|7S@_G#W&KK!=I%HW;H!F&q;O9L$C$?-bR0 zV!Wd0s3e)`!LU<7mJnfyrRFum_&_DTK=mF$wuzNcX5-BWZx_K(NJi$ga9ZGRAFR>F z4t)6O3LcSgo8a`!*@lrFiGOcDWw1Dxh;*e-^iL2O!*TRh zkpebyOJ=PToPOpD#pE0ePs z4$kHNR95=TChrRw=zN7c_;vk_;qzXk;!#@^tiSy?#=ow;tw>myp!-5`D_PlDwv7PG z!T;X7GY(jjuX6pDLT1Jc&|44vAMb#FYXW|iQvVC=Lq!i>kvHja#!KD;KYpGMZX(u4 zs~B0UvzVNae#b1j;Acycf+3V~M~G#!?20uv(9^~Og;Aeg0AefVij{+UGL}0%P0|gY znF4Y@&NGZ$+~r1&}jIf`Ap%iJN9AHtyMt1|FV;)RAi zogA{}KFzHOk&0Pn-(+kH1xmGmKP8}l1N&x?Bb_7DB5+objQds2UYOLHLRy(l zixGTS4;oC>8<1yD7)-$}PyTOn^WX1US|0$rGQAJ5ln8Cg-?SCpVxIguUTgYUScU)3 z3R=d$q4(+7|FcblYMtquGeIH{(#l1#7vTLxb|-E)eh6VC;it}+XRsqzd2im^uZTQb z$-Y3ZfP8oYtO)j>2BtjOqz{0^GcQxunBEj{Loylo+Z6>d$pj3X_lN7%geysJ$rjS} z!+yvnTfCqsCsLvTp?&_mpWs2GQok29Y^5AnwFC;#!|6Y}6)@#I0fiv)l|bDYGen0i z6dO5Hsv3>4$e@isQ;5ab=77^sOLM^R!U~Lb@TNzWQH3dDOx2#vuKA!bpQvu@)^Sa2 zxt&Otf-)Q9<;yWf;G27^No%H6r>!J_wcNjx6yCw*s$-QcqRu$fjyi`|M5Y2q^bE1I zoS~-Vo$l%`fK?vl85@VjQMGMHVc!K*b6Q)JY%9E>ycY>ZfGGMMw)m zod2xQGWZ*MSljx4wy7{$g#7oyi(TZS6&&8+K5OtD&Pn3AV`;$cnhijOk+t;a)=q%4c}lNdu!l) ze-;oYp5+Vzw1R<1h{^;o{kiOf1|D*DVOtF6&b5N`4e){+RR|>JC6FNtuopQEZ3go~ z`%9zUz~51Md5$r-gkIK5Hbn={W%47-#RR%FS1p9y57Dnt*yYd2#Aj)cU^Xp;Dfc3~ z#w~ON6vO0h*i>_A*iV`YPV&fDSM49;JTC`XOc?CC2`B4m7O1AW4VZ?BP^&KO0<89k zd4#=L;+|;bfC>RWwImqjNQ_FB)odHfkv;L`iY@C8zUQ)OC8>?HInO7g!%A@I!NP#z z&y&Zc#{@3<5(*&Kxi(=SWq;KPMbjH|fEDq6n7R5ew($woc09|mU+?UJucK(LG=@1H z;{09OVmX_54?f+wd`$m*Zahx8m2nC-*D6j8N@}&Z!U?BCR8CTv1M>9UK5n}fyjmzD+cgdLZ|mE`d%Oa*o`kw5B24|c;s#Q(p|#F^ZT9EX-Hn-S!J znSc-Efx0|-+S{TB#a6!R4Gq{6`~n~Ae^&JL{(td5Hz6IpdJl!KN^#~!q|-a54G;~^ z3x`JBgV>@hVK-Af{HSG*5PzcciR;Nr!pt+8Bap`suQZk?j+w3n+a5-_$b`mga`!yc zD<2QG47P|>5?!=LfPf?+rG zZr6H%{%J$DM|)ET<~VQ-Jpf>ocA_zh-Cc|DlwlO!B9ronsisFPKewQC>p-PrKugK{ zGoDw%l_;kw^)_FEh}dn4dA>yK&ZaPB3|eR@qWf^693|THhl0cQU)71Q1Ejj>?w}dptM#}jM-{7hegTt%ivZOrpkG^BQ zdbkd)46{eu3YGcM1EqCZDc}^vr5fqX^w)G6emZJqvtJpLnV1gf=}#L8>4luyNzEDZ zI!lyH7E*_>KK@lOpM8NqSKT5;9GJ=@XXlaC19iE-FLsV1CMKB|^+(NMu*r^>h;vii zY*WmI$zxxW{85$4{(QcBA`uD9V??4tCxgm~)lssoX&a+bqo?8NS&2hyVW`NrTB~V< zgO{To?)beSF=S6cISWp{p!hSf)qkjt{|c3|UaVCXGE&8`C`W3T_nnWLjaS#guIlO+ zImNg9L`Om4YxtV{)qQBA%t>}B$YBmJGfy|6te~z!zl51?ZFT}A#vNaZP-{vM8&##V z5pJ(dZt>^TfHCi`PaZRq`ep`wHD2Eqa66{LDqs@cii8A@32QtSF?iHLDq9(C(imRG zutMBMo>C?5B^RNG7HKHSVd*I65ZjEAVw~oSaU!5k^Kx!k!CRgD>qlNyO1|qYI?DvA z`vtx$jF~a`min@RS4;9{$M3BE?YGdTw%zSudZgXDi?DNddMNCcpey0}I@K(WPPqP@ z=94QbnGuY)n>8nt&3JoX#Vx1EJ-wKM(a@=3xQB|WI@|&F&8iIGAK@U$-r*E7I#;;$ zMt+D(eJY-9_W)9-z@N#l$ktwYBlbU9r0(4id>fJ}<RTis639sLscWVZZ@|$ce zR$^44_gW}GKV(}#w^WIj0tho2lk6ER*s`00iPa{TrO4;TotuN=OH6$RJKW}s_hN|W z{Hf}j^`IFc4}R^1j$vWOtcqvbu-Z2f&tkClkuOe2mgwZtyXRbcq3YfMqPTF}1WWc| z#Upk1EpmSX%hh|68NQ6s_2n&mm3JfSs4j}bSZDO_c1F`;xmq09&1EUXKw}~CF3{T= z>}cz@?fY;-QA^b#`(az{@4qU`Jk(f)tAb#O3EH0`OWsE&TtZD)HGOI9f*VA4;VJ}` z;rvvu7fuwgtWER+twv-lIs4_b-k~cYe$g3Ii;_CZG^4Zi?Z$%sFiq!MlXD8*6*~u) z0T>Gjg#A|-Ll|sb38wRy0m+~MqTeV*0&M6O&;%KgMJ3-p#IL`47K<*q*YRY}!N8!D z)5ngYh|sr1aZF6UN{5UD!8hbpBhN#&bR#9ZQ|K~9W|%E;SLlhMyeMOMT60^qWrrFR z12p3?$>Yx`s!onF6F z7$7S@o2b!o)Zxy4l^)8{@et==>7kJ~Q={M2gZOg&z>uqntJE#CaUzQ}b9ituXd*xH z>#NcEeF&(9ecP#@VYErURJb9+vZi?#ajhx%pk%b%%ce1<2ocoGUA13Z4F#$16-v~p zqHmq_rI0It(dNQ}%r`^AP*LO9*26iq^~@ancC?B0k4l4gq?9?E23!3v0bKrubj%@? zldyh#h>v#--r+Am+SVZCV-(y3w`gQv3xjB|b$At`R|KK6U!Tog{d-4I;f4aM#lt^4 zU&Z$id;urbV(F<}FJBBMu%wS#MLhQ!caUloYE z>J6hz5=${qw|q?QJ{f| zrHv7A4im75i0>~aR=nW-Nm`y|O-jvBWd0qwtPz7gMl=~w)Y%i=O`T}GYiy%r;=De% ztW;$_$Ny7)EqvobE29tV*^8S{Rz#(e2ycX5qNR;vz))d@(l(t2aiX7hEQBDG0AgNK ze;-uQNHcJH76Y_G@PA;HO(qsowTo_QPyrrOVRS!u&B*HT(E{k6H~N>|0qh((88IUt+v_I zP{p*^)2J)@mMnu;p*0BLRD(5c3jbm9T7CAYo588Z`**UZkOx51a?0sgLb$$=2#QZ<$WpAQm>hNdzR>GDqCjJtS;Iyso z1Ud~XuX}u%CmIAQV@ezOVSbLJa)3g`x{VYAWEyXZTMxebudvut_`nP8sI1Jj`QlU7mD3zAR~d|H2rG7(3RjI4_nU9)>#8c}`!{865Yp1qb*h%SF0&Fo;bWcI+vSOxI3Izq7Iqk%Ev?oP>f743Nkj&gXS}VG_XYW zIFFnEiDt*XJzVuRu#3?RMOLMX;lf$C*t0!0^WrfQRUa-9ZVcaE%W8(r;m5o@%`Omx zw~;!?P;B+!y^4wVurB;^W3$_syv3ef1q$xP+S6IjDe~R<4v8-`LIMa7NyX|5wM4gt zy0Jg-$T?Dus+r&k)kn-GLDcKTbagoE=a?&-?c{2Y`jj>&P*t^{2WPlO%S#rb-h8mb z_I44q*G^IU6z|XrK_1H1P-gSd+QYFUYC-emjiwo0&|)31V+M;U*>n;9z|f?^*exZ7 zQ7xFs2)j0vd_c&IF;Y9CtPljL19yBS3ekjlr6&oKI6~Hl#^*a6pWOgVDU!CL9-}D>;44=cLT)8~!!enwdmn)d6oX**|TiBNsIx`48WjirUn{PERrX z%h=y!u{9GbY;i!i@bhNEwZ%?b)I_*FS9sLKSdDS|@UOzS%}dWu+X ztbcJAi^p3tEA{`^F~E^)P4;E>uQ%$x1Ij;Jk2hfUciYd1WuB{Xf;gI*RR>+X5rQ|+ zIFlqDQ?XI6hS(TM0s$@vi2#BDJmh<^r9;3ou=AV7UBr> zj;)Fmh;C$8Yi4A9E0sFqRdE%={rHj#6Q9Mi6V(INPeP3xR~!fktv&;^zN`GO*8VN0 z{}^5{yl2Gr7v~(G`agi9v#-CHZspFkYLoeQA9CYyw2C14H>aj5h%h3gF8GQF-c-zm zL}80B!NFN_6us6vOP<`NaxGkUHo>Qc3#B@82=m(8R>t0Q|dst7Tg8eC( zo=2NMI~UyeK~y_YF44f0+C=V{0bjJQxfRaIIX3xEljXu4xNJd%mU>1paWQYdQ-2;N zo@yCI;%>}FvQOiS^r!h*`!9XV6JPxNT`Qx^>1tLwSM&T_n`0~Jv|C}bB;{! zw|Hue)XP_GYn2Gza0$k^aBDMHRXOw(Qeim%Zf>CS)jsZ9NWySp^(K_NtOPRx2~kWK zJSO?J`5g4g2v0tygof|sIgY;ZpPBY3QO{}2{)A^(G_sEiL#0WXFpr+BloT`gR*T5m z_wI-XaBRNy))YaGcUBM?i!A5zX@Wg1JY#?Cs(24#@?*AqaQ0wb2yX{Cp!U9J+`3G` z^nSv0ehP6TtPZM2Vxk28!bolU^NI;=NR%bIeUX3I(2tI^4mO*`?+^kSzq>wjwU{a)F1fWC$py||%lmTrJHwAr1PMjaazD}USZi{T0Ekct8x)V_dSUJVE{-KPnb#pGw zc_-nGtCY{n*{z65iRlWOyE=xYD(;<;G7&5_{s-47f-7WDKSxc2RMk8fft9`3t5g!R zySw}*j{&c;@H}>{X8F#R1s1+~Sg`J0U9fJmUN&Q|V8d4DS>V5df44pz2OlEWvx3j< z`8GYfwrTaiQ!woZ&t0uh17H!nYGW3x`NW{uksl*;yc@JExV~OyAKgOP0oHdJYHGF%WYU^>!VzaPWsd z(>lU5l|^Y6nQa>+FKY}DrM^k?(zrj-(YljaVeXsFPTvuav{=;qxNL1}dd6^P2in&a zYaC2`r2JW82UV4>*&*#I8!Hs|!CH0?Nl_=z=w|zs0WP_tKfn}56NR#I6pF9;lgr5& z$HiRC1dzMD01AO;uhRv4uXXr24TTj_zpb+K6deB+rO3kmSDpEw>r? z=2P?u?C?4ioi?~$Hf0hpUm*Vp2$BPvwbTyW`uum?O*z&!n7}HA)KGsnqIq!fQOr~9 zaL_|dloiLuB000Ipe*_CEI(L4p&q&TmMQQ1pC89g7C!Bjpeq8+~r&EwyrTUParNrqska< zh;atzRm$;~l~>AyP|k#4DGo0sq1f1auq`&7`(2BHe3JR=;DWKr%ZNO1J)w$mHF$lihM}vWAHVC4~`RMEnizGObV9 z;{^hJc~)={4x-j;muDSbOxaT0*$`+uQb~a>C_^U1lcNnFI0SuFOF!cWn62qmO&dH=muB>hJ05$af!Z z3D}%<@!@|Rrqq5JzY1U+{dn-LIjeMw`VsEj=G`ZqScI-KFi@5WNysoDZQLiF14HAs}J~gHyMC ze@)ZM*p3}gJ0%n0E}~iu*7VlfZ#o@~I_}ki6d%zd@OpH2!E{!z5*mlO+tQ{Iih?`w znbrL!4=X^j*qY8E`o1(#MDXBJcH|6`hTDHCEHE!aUuSDf-~%9!`EZj-Go8v(B5>YT zoWD7CijS#!YNX7h3;!`nf&ogQZI=6(3z_ZmsT267azkJ|wiUXR`lcc}ipq_sy5Dl+ zzjCvX4OyZy1WdKOpJ@1QF}?;jC7H-&Atha|oWW&LE@vzUu;c({vcBEO0c5~083_G> z8|H(`8Mx7t(PD>U1*;q8NjKSTbE6yP#JdI;U+h=qzr^)D(M724sknFG?e(eWK{QW@E;&a=LYNT zvB0ysCY#*Lu;4``-;+xmUW$NA=SIv5`e8QrQ=fnT>hM5SbJ1dpmyp|FHK2U~yB}O< z@bs9VhxOe#0f?r!s7p~e%FehMxe?!aw@+Q5dRf6OuQ?CQY7AbC{6P5 zVnXl0HrdRHHHGXVz|I=ej^-(0PGgHuc0Aa>gLHYY+$F67j_Vr(D+?G^y5kT!ODLwk zqN@ba)&ZRO%CaP;12v;_HSLZ+=o@_332_H8KQQ3l+o)!1{l#*#ygzLi-- ziUxl>MLxMmGVBF+fX#8U0gfbn+bk@q7lF;kXXDL5*$dk=JdW(G*Kv}CBO(5)Q(E~`Qfx~C{h?l5gN%iPbV!ElwI5weyi zc5)g@-GtM+BM(IqM{dM+Z>m^h$+`?|o;^?@_=-bBp~#=WQ`fEH-1U&AP|vt;#>yqM zOqLH&g0%1s#K_U>RYM+|o5SNP{N%6)(fVJi^Ym+- zLR2sNLQe*l-A+0rgW~Izx5lxIQ2I=qb&M*bV5Ci88lw2dM{(gF+Q zN1*Jq3-Rhm)&}g73o7AKUsy9WUf@-pg@5=k9b*17LvO>cLg`UYCS-pmz!86M7#Axf zyr`8knM^U2I93ke2LP3gHh(5ri20y71{%h$s&HG$z9E?8@Y9s(zXemudH2 zWuIkEP}x<`P@~5>{JHmf5DjZ#$ebPWxhyJ3aQ+pdZwgQgg)~Kn4@V$xA_Zo=6A5N& zCA~4h5{^~hhVy{|gdbK@BiiFVE~N>NsIwjVAx4&b?!uG#AUmO558{c#A#CQe|JTyA_u)WuRB`* zIO?WcZR2O{oO$zy-wI4<&3SH;b=zNprcKz668lVF$9^%s}_ft(p2|75foGvr)A3{ z(WWPcY?OADf;kr)$Cvt6J*V%^>^KucGrrPRgYh9WvW*&pJ|2<1;{-qw#klYd4A zhHTn=a9@84qAJ?NOC7Oo6OJ@YD_6JbK2P8sQ0G5gZ2;0dJvsu?j4@cn8&nlmV$&sq z?P5P8Th|FbVWlhnj_1;I@^Gtt`W(HGF^1#LI_H_m#p{zf?ZgP-N200sgPof~Jarsj zSb96e{G0!L#3vXrnQv4oXV`x<*FRpCIhPBG35r!pmkv>A+}F1SrvKIr9Zp*9@QZ%xRrm>HmW08w4;~V z;sFP*>EZE?M`F4!(n1U11e?!vWk~d=&@97-_ZfE6E8!v;zX6%pOZ$)Y*>rh5e-Ee< z2}qO5MB~Cba>OkT&=!>WlrX}fW2lRXTxwq@3`zk=I)rY%{mKrtKK%oU*H-0pPIkpN zZfelY0aa4RvP2N1Nurt&9GTP$hq(p_|G!zLl|`;nr)L%*Xd zQw>dv%CbX?q^NxG1TG4W3UCYu>d>?WD#qrO`Yr(wR0aRUuk0)}_bwcWNb^%@ZDneI zLhffy2})B^xhIpU<&}X}T=>5z!T&Ed%F;LEW7r@=U7g8y_!f=FBXy&$q*#VUsA^Hn zw)fdA2ZqEiS0TQRm!D)53~dw0Zwj>6Q|@Nk@6AYRb@T~8^YLCdr+b-tl4I^Y&LN2! zv~wn_U)>3*i;e~M7E{hNa&kq~YWOt2KRJ@sr$DuSv3$NOJDJE?o_R#1I3(#t+QH~% zyosiA;4ZLP)n1haUx0oA!KAVA9sfMo=5oa#Z&zc8kU~z-(I+20F*sO>TgG;;4NT3$ zyfCgcxObHoWH)GICO~gk`I83zmw?j0FWSsl(wm zuBL;-;rYU4W^MDr8NY_*R(IvkMqUdH3YCOF%rSR7dBI->3Y6gQR2oR>mIv%RnK1(b z8G%`mO%jCi0%VLD<_==k3?;1M*_q#}rrJ?mL40Yq!AZJ1Wy(7p^XyGUNGI?RD61)?#`VoJa8Uj#b}AD-Xv?OGceTK<1T6uX);XM<%PPn#9T=YhPda~Cn;lJBP- zJl4I>1TL3942}M*D^iSTX1Xf%+=AcUK#LYhWzTh=D_kZvS$&yh(O)?5o!Gp!2S!P~ z<#sFa$MLJL8{w66nxjd6;l`k>m-~g08HT+~VM_U#$$;}nq9PQBk@%Uyh7zU#)fww@ zn%G3*3y7Xs06zA9gwCnp(R!`D&BWCqj9P7Dw_ESrcJ+;}{n%PPxpWV#=3fN@f8bN+ zs?nw2+5gsA84+B#JK?I1#dgh%UsnOJQdA8U(iS5V|tm&Fi+XP4a zB;LS%5^o&M0^~;UUkWy}S$=yfBt8qTtX+V}pF4ZiEL^YG=HXP1g7bW`d0alv@eRfS zB{fgw5P#wkLH}_{);t?632k}%>-ISk(--WI1!B?pxUt6p)S+b69Q=okX4%lDzzvK*+nD2EGc5ut1*>ljY>=&m!jy zDMH*7E~*Ol?>z<0SpoB8r9xudfZN7Hl#!nFDss z`i(9C3W7r*eT$9lhaDafh_eyPB5bqZ#aey6GhQg~?EP~&v`Dzgbb^;GYN9}V zSPVly<|>Tzs}xr9YdlUWaoF9p>d-hjgMdNl|H&>c5yOKlU8j+T8cL%rDs?F~i)|DZ zX*C^_A(|q{qtactKV5Mp5`t@pyG+3&ox41i~ozy^{(JF@6gwHmTaUFuZbJFT$uVn{%IDn2h^z|ul^`fORw7TZF`y5$xI7=`CMbKb zPu8yw{0$8@aXl#GVSemdJFbq1Mf)|UG4Y)pv2(_Z1=BfeeTp|`I%DBWI^UR*)^8$T z!cXlPh|jO-;bE7&2*NOF^#spJK$9^ks-ZyA1e)b8&4`(YV>baS#ih)t(4vf2@!ups z&e)*Y=RsD|2sY5(Rn<)1vg(}7ddJU7306b*4_g-Ut;*o zXT+-AS`fRD6g)2!@%N34yfFwmlA!H%USxJo>weg3gS8ZibiPC!VuE0gB79&z8aF3T z^K>Uo2#4;|XYWYMT2X76XB+Hl!#6DKavte-;6Pvlvjfd6dGcavzwG!a4>u>jrq-@B zh#sw)y8owaVfC7dj(=7~yf~cFGqQ(Jzlx?92wU5`2Ad#k@@#4C!L#ppNxV|GFx~JZ6H74_S-9(F3O00 z&MH(4`rad^U!9%^h9iOtUFZw;?bX?l9sFjv$a)t}+la=HDC>D~!WX~g6Gkq?pi=T_ z4_(QIqmnfZ_W1TyeT`IxDVYBi`|vAgTjhQ~728^Fdu02MuL*ITfqg|rea$B!eROZH z8$^xMyCe79{ibm+KQK&|n*=HSVC$RROF>dj>s;*pSjFmNP|4u8l%gd`2n-u9sJy!y zkBEr)NUL^pNuw?b27wKl0?B!grv)^2Tey_lG`!kya|8fCr`|TXYbCZ#{>)BK?yhBVx9q&}^4;t$yg0QlDM!QdD*TLet8DXDpwiap(62IbF)clVq&A8Yh z(e>YXJ_HIH<^j@ahkydLVyIe`!C6|`0JJlsEnD}ilL;=u^5CeowX(kS`vBC^TU<8u z=5t$4=D{qSolrtEjjl_Vbzn}xugnU6VFuEh1ixoXUsf8 z%$3|)k;={Bim<)fBj^gd{BJ~`ker4#hI>IgG_M3%b3{iWVRMi!82soaSf5l$Y}p3OIo zYtNysZ%uexW6{-U_gt@YT+?3}#smtG#BZU$=PUU}g6VUw?U~wn4m(mUc6a-RHXWf( zmdS1$bz!7xJ+kLBi@REmxr?)KN9xRD@C56YHyiAHJE@!xxIWRa1v4qbE%!2%n{*0X zEH(V`>`n;sYzBi&|1+lapueYiY5(iH7ieCgQi82J$|B>*U-2P1tt7O?8D10Ici?=7 zW*VQ9hYiib5;jtjNcCH59)_n12?yV0PQmXMM=+y`02^;k>oe6)`5|ud06UE=-K{LE zFS=t6Pp>q=nq{P)4YM$y&R(e{Djg4XgF$}#q8~=cpXuiZ6AyqssF*L8qB_197BTHg}(9rFcbgUj}qhd%yPhenBo30t(4N)G|C zDoyCC+fR|LMOJ=l6=GIRfrnuxtL!jk+*Hp~#nirY_$;DD*tvdYpONZ~45Ell=;H>? zx_9v1k1mxXtQ^spmD+sG3z8oe|{gzjil$22-vxmNDuV*8Jl2`%S0;U z`lX3(=i+IwMJ!6(!T6n;39Dx>&Ndd=TB#-+yjvylN+0!a`5O_1m5K0Bp1DqG>1sPH zJ`=NkG&BN`{^RYG(g(_Epx|8nHZ8)4Zvf-Y+WF;A7d4ENQu;h7*Kys+WZndsA_{r% zZ)YI|$1g(AU+mDOk~T8SjnMXbsh%{5q-b#|^htN}aK;;jd^|LeneC9-&in*uzsjl` zr{bW)IFX9$Q~x$W#(`!&gbn3BGnG{&UrdK~PWhWeLp`nJj)!(u>sVWCH5~*fn0*3G zpq)*1{+zWQW+<5P{+$SAr7M`#eJ;4k{_pHFfO&HqlI$M3tZXR@>gi+<_Y2uY$uir2 zz$K*(w(Ft)Hu+o(@o&(KxBH(!r(lFR*KsHh{LSTBzN zpx(oZKitvdD7Ig}d{2-tIKJm`@$3cBPkX@=gK))JV-@F&+NDjkjr98gkRJ=(p7`hV< zXgoy>w$$I%be|(lI78yg{~DxB(mONRtcfRnZFr!}&`1{{t#l7!!2_Q#qvM;BGKsYO za{gsMr%H!E$Vh$KW{vX4FLt5x9sY0XDYkQU8FEIQu5PDNxL`Qykyr62*W7OTXBnv< zPVeyB@MBXbeBM$IQXjp(&ulIwDK~dc|&ei6Z8p-2=_=N6^?L3nupn z1yna;U~(ZtVQQh5;~>(H@TzZ>CR$UmC$w$Cw^FoUxe@HJ&I8)C$yiy1?yeq;9%5ms zonV|Yc|iE?t_*e&I;RLZ?!`Jh!F+4ZoWA!Q-M$bAQLgKb;J53o5Hh;%+_76*4V*P> zZH;a_a%Z^!PY}OdS99QT?kk$D-fy~imaq&vW%X6BTwb-tw5)8|KL_^BVqerUCGq0H zabNyq#kw+RH%z@~^7QmJYvmx|e6vM7y*O{maw!3>t)1LLRW1xW`MBCG;x|D}+jj5= zDT!4#bg-;Cb64`5pSz4~wXO^~@oaW&ULu@vdFqv1-98NSOq(xab9oNjU$(Mf#fTN? z%CvCcT{gPDHZPnZJY>GhVV>gG(X$pGxvcL`Z<)`OxSZeVET)rI)7?cBztDB%y|?(9+kxE} z#8t5Sn9XXMcCq=Eale2m5-#H>{S>O_yy~7Y~BQl`BsHeca<8@8&h%tr17~ z;8k5~fMC@@-9gJ=BBQ*anwfM<_JyxH_6g2jqE1aV?R|HI6a(=~TVT7cnnQUMvRAM> z2DU~&NhA0qkgr{5LR4{uGwr=n-oD4J1(&rwBe`VwM$XMV=S~}Qp8$ef*B4>Pi;D(? z#+J_}0tM49EkSsq$sB|#Li11|Mbkrn<-cv9YNn^;pw9L-$$wq-X+ z`JCSjvJW=vKf8O%6-M+@^@ExQS4kxg)1x`cs?MDLhDVpd`x!Z-;PPF&#)Il1*lv?C zEgzkYQq@3Rl^M}%L!zTKvZZ>H=Qe+DsaAz2$gm3%f-u?ZgaV>QAmfYkwA3ZatpN}N z(#V!V@Ceq9IaD^~?4>j%AF@1E+-fC>UgL`oLfDjhw&`KKoJm8Huo3J zvPK;=LxO7I8#C?jbpYV1fTpQ+x?kv-Pv*WRkN*e3hZJfwo2*E^)%+}y0{Qzadb5)t zCb2fB#U(7tc;vJc(0Z9S))<-^GZRZW;puANPnfHoqQi2cyF+N2QoY1+SKn4J-2m`7 zB<_HXbQ?^fjVHmL1QNcRWJLi9P5{XxRm?GMofAUS4RsK?ObfW&H|Fjdi(4x01iNOYU*c zv5ny-Uk=WUUL!A8x*~gCtQ>2DL*kkjycCJpdNEiCZt=OYzNH#rR%t}`NK#4!tPCQJ zRYUlp^>O(cmO+yxwl-OWp6826HLB_;^g&O4;KOIzFz=r~^NlyvzWpC3{qA zYax=IFaDg$Emi6xSKRLKV$g8sW>j85abLCqIfSwjE_a2-#zzZ1$Kb$ojWPn0j^Z40 z0TVHD89|{mgQ4*Ru|(gu3`YIZ(^{t%{YOynO@J+XeM_IO+plMH+!qH2KfqIjQMkt_ zcdYT)gvbK)1+BnEvmUvE^HTB2oXnHEA%r6yIK?#0>c|&gqm88?@~U9NUMAab93CX5 z@jPP_SusfZq0~8WcX<{BVWv(c4eptAIc?XZenM^5(8mHqFv1)XD4++uB8OzqHk9GK zv^l}EPf>Ye{)2sNj>5$EDEG>b31IG|-wIjpJX8~|LY_5jfQ<29c{7H0eh)1pLB*AU zSd%^-@FBJM7nLg~e>ul_dRV7vbymJ$R&E1^r&7&TZZQa$~H0I-B=&p`Mwy=^6sReI8^K(EdtQS`*xAoE4=_G~rkpvQ0 zBmo*;<}`jYjs__6T?H%sqeIMzO+;m4({pe9bec<`6 z+a^8vmMxN0vav-|m4#Cqd{w&=9xuQ{rcar%^!yv*WR`!EjoJ~WyFV6P!~db{9b;?@ zm$u!uZQHhO+qP|MwcV?2+qP|EwQbvd`rZ3`zvP_cWF}AM7;{u*B=c9*UH4TY%lKg@ zG%k&GeL{*v@=%GB@yfwxtO1kN`t1zThhG#rrV%z!Hj{Qs6H1w|cZ(Yct9n0wi45vs zB*fD=Q)5l&F*77YIb_N}BB16CaXfRQuyTBc@-RjUHKlg(#7>Uuc*k5P$r4YR!|Ali zbGe}8BLLx+?At`t@HEg8%{!6>up6D`#J-M38yfV{0$aha6kA>C zqQ_A*OyJ<+Lam;}__;_=k{Vs&(nmJ6jO1)~@pUwh&sTS^GV~&Ez(n9mtMKZ0G z#MEcf~kg1Z#rKFgW%1BY(tOQezxS;eu5Zh!# z#}{M0tf0WI1{xFp$M6lPl`KGLfULDonMixxFwqZk>_G&0Wcb-T|4UP2fI;u2(PTEF z><*$o^#dUp>_L3pvwr{>+E#J9kr{|VEuIh7PD4mw$QE%|P$|M5#ImGHtIo^Zh2HjD zYZZM8a$A438Y#x755RJod<9IHwBHuGuk9)c@;fzOw_#rYu1}dmK){a_v z>}>$x=8N{Koh&Khyc6e8fNL%*;q-2Z`@vMxqs0^upXi>x>e;>9_jLDE-gu^%`}wZvuYEd07p+D)9JLo=nars;ZAqeSR~2W3qg4dcRuyw2s$opu=C zzAn`3psZ``-}PqDdF&SfY}Q5osU znkrDV&^u?eGbD>+Hk@iu70iR|>1P~!w4dSz3M0^lZ$nsc3I}oqQyqMd=Ali)`)JQ|5T%(z^!7=Zv$pb~9Y3J+ zh!ec6igF`dFM!9h@vdFs0{x7f)P$7;rw6sY4jTx>zgZXnAjV%_Vz9Q^FbJ0D$ivH8TsD$@tpzEtxpcCX! z?PR{Ca$GdY!|R{7_nm)esai1Teh8ZMh*q`8?Z(J3*a4=gBcA*s`%f7!S;Ssi^}boM z4dQ3iA3WShuXEMaEwy$!8C}3ngE#K|f)7I?%YVpj8R*T;?_{ws+cKW`P~S$Xlo?bmxLJrzmlNZ+*+qhyJsbtXJaU zC;C~r8r2hScc6oBh11;o$i;2~KT}z>EX4(+b55r$YT@X5TEbl2>Xdl)`QmsL6x!(2 z)JcA$3>9=KdJr|SGSHXrTiF=l051BGlW_n3!?IPM%GT{%l(+ogbLFfRZh2w&I5h+D z`#JZLDxhQ^*A1PB%()@4V>p6xPtZ)@VacPRDd_scy>-OPlTo%YPF?tNkPOK> z@S-kuF5j!DJQ{ei-=F=u`H^0*P^lan0?Qj`_@Zrbx_$39f$*w=3ekB(#As*iNy-uJ za19qd#tk>BxZZ!aMcD~61cRmzKb#FkkI;7$(H@(-cVct>Ffr>?;-e_w(M|$MSBfRu zPIY_HPs(!1gvv-sOz=wlxYMAC<3V~jzk0sO0S@ zrzufbH(|-a@7_VZ7YO<$>OGiU-@d0Pm}|(@TDyGW9k7a};S8JMeJrL?q@)gaPu>p~ zE$Mu=ThnVUA8IPzlLDg1KKFj2PR*q}@&jO-`>nqFg8l}1@}xpR=LVG&`ElA@93h; z9eydyV_$Y>e#`P>e=f@M+F;5mye# zzWY;{6b-UMdA%$$geM-|wTU%ec> z2l&beMKt#einSOPi9wgv5Ju~Af-EnVUL9TYx5e8#0p@4?HAe536vbCPE)_Fw5M3o} zVQhbKaJ+28Cac$^<#$NBadscE8eUOpzr6LAw!>J(*MTR$l7pRBT%^QNfv%l-)Lbax z-HgfE3yyd|g@|BEu^5EQQ0V8-Kk8Vf>3FlBh_=tq>FGodGTO0Or0+tZdcV!nRn&~& zl0~gV$gws~1|%eiFWvzlD|LI2GkbKA!f?DrZijuR$oX&QB^31i|IE#P{nYy<>H2Fq zA>It+oNUSXbFU(n#Vc+`VxGE$%UL6OlUSil*r9JXe1H7B_Wtz#j{0iw({(tr6bJ6$ zX5#xr5+qm*PBTa;TVLFW-{I4A=i@72_x!%0hKv-KZnZ`CQMvU3)#Qq$igEFyE!~7D z@OSGEGFAYta4TnJ`vKB~rwobGt21;d#c&qs02Vv?GfcEMdus`UUK`4;k3`lfSh;zt zh%=~aRA@qz?c5DHGT(ufLJI!EW@AzPfLR zDv&Nkxz1iub(UnRp)p-ggci;@<3RSEGeT{>ZcTODmvhXIbp!2(D4&lw;njv6Mo8g}+7 z*iMPC6EYiS`D=d-Y!XL;K_agF)rAc8H)W-pVs>4n3u}9?3anN?pv?^vNI>w`@pXv! zMyCUPwpRbvi(%pIZpEuR~c3+C52tVH$Q5i`ubHp})&Q7VyLc+%spY;!nQQ@?H ztyhggTMOttKpV0SJG|ieH$osz$~j=+ z*4J#H!1Mn?#fjDH_^~*V>U`{LT{eL3C#3!wV)q@ya`%nAQkRM1oJ>fwSoCHWK-bs1 zemc53t{*R53YS%g=V_!_wEqt&uJ~FlX9SZl+sMlF98=&hU;&nM?g2vAzO6JS#b3Ye zAgOL^L9#^%dP(rc|L5fAaNFtD82|g_)`bMa{_kO*`zw<7t+0n^X{K&Q!DE#Ydk#1H$7+gs)2O&hhAs{^MMPZe zITj^U9g%fnuk|ncH{*}ZR?)Mqt?!0qRO2N%<^P4wXsXGrFAJ%TG!+k&MVm)0-|}KY z=KpPx5K~ccLJhe}#c_=&>S}Es?@zy-esiP$g~TB_Qd$P`yzaHGi0K+fFRV2tk!(UF zJ}>LAOX@R6adJboQHdA_lw_#n&gVd82U(`ha*32Wd@zktF9nC} z-lg^YZ-B%izJc<9n;U+AoCJ@F&$tA+eb!BGF9qGDbr^uF!&dQ)56;GqQ z$iHt&X-MW>6?tCdLk{u31#%^cjADi1O7=+?w3q+>4=gUdslKvEwScu+ny}e~om$&T zZF3%_7*ZIYH?Y0g^^XgkxM`djsBONsBAXg<{*{)1#ai70ArGKI5l*>?IQ{<@7Z?66 z(9-R6pb1yi$Djmvr)<}9OaIiqLwBsnF~~<|0*Um)QY&-jlONZJljnN0^m8DWj6(A%d0@xms?-UT z0?n$QHK+BLAH&YDtPdvh^lJ_9;PvikDC~u%w**Z-a!|c3bU zgS>3VlL%H31Y_w|&o6An6GAg&?%_Cn+_N52R{*m1CBOEsg0#QlN9$_7fiTEu%X89Y zQ1{#^7GW=7kUB1^8@JEPmZLy10Bu`t;pksM)tXjhpUl(My^llaCkFQPZmLRku>W+E z!|Tt~n^RQ>UGT`88sg%sZ__E7Flpc^fK%ad`|atrxISJ_wTxg4Fb!WjVi7~1&3{-z zZl<)Nr$m$GvGAl*3;YJn#c&g{9h2N!gaSA+aX zuH)E|Z$P?WEzygH!2^C6+#t~x#Vl#S!vEyGC70>R!cl4n1Ic}YYR5=#5ZgF<>>eh~ z9DXw=ml5z1@RUk&IPd`M$~Y44p(N>I;6z=`7h!}nOhDA~o_mi*aA|h&H9^lOv(>{;ASQyFa)P_Nc zN|RKdUvVa_r+q@ucWJL|5+$`UclL4hhY550>vA49&UI`Uu=&zWr(CY<`;6V{j%(Le zwqNPA+gjg?$H&D|fy69bofb!O#JZDt;(u`oubP_#l#_B;3?QB8F+M7fab4VZWuH5@ zG!b#QpB{pvOLb9_tN?!RLx_-BZAWKFZ26N0l;w4hG*$I-w(TsFkvsy++(W>HT};Y~ z-vuy}RNU!phHU|ES04=p+YcU3=6XZGPbn#>@{i2)iMfzgCE7Dc-&r@7+eA^9a35Dc zx!vv?cAFXt!TO+l$t3ndJj#DdP2;4fQky#_ic=2Px0EYZfC7txY2$anB*xeEu9t6a z^{1C#&wH~x!TF{5`*{XLMDQHQ03!>ADyo`WMUf(=#(qB>K8O)N@stIu*!Vg<86-b9 zm(T9r)uI3F9$%*9{A*3Md^^prudXhyuAZ;9%vxUzzWM+14GLYWlNxP^i})tnDW6mz zMrrxBWvy6S8Mwd84O-r~$&}i*PRDjP8eemwF=uDfZP+%aGuMGzgqIKFx*M+|+x3xZ ztsr|>Y??{kEVFRbFJ7|0@4b9hca+OWJ8v3(MpjI1_vCTYfPoLTs?rTuLY!J!ch@ff}@evOhe)LeK!#7LcFgXvMe zo}d8Tg92fezgr2&{<~{U>^3a~zM@I!C)*LqC3wVhS5KEQUB&WhhCZfK1L;~QxBY#} zw<^bP#Jq;jICmVA`e~p`>W*YHPOm(H{L%r8OoYY=UU+bFt^IFw{NK6FK8K)$XAh$xsWz%{0InFrc05|h>8O82_&@@0Ci0dz1saJ?qzqFSh@NCIof_C4w!FAV`eqRiqIu{7AEpj@@9@2 z3v~Fn*s18NoeR%5%edIB@|+9Bx=R1gRmDsURR^tGI29zEtDQ>P+ojam<%M6GvUWBR8SUH zhNd0LM3Lb1e@2c(XATP%(L%Z>N@>MMrV2D|NTcF;)4}|6-|gC*CK5Leh>D<1-lfW8 zucj)E-@d*~`d_4kc*p^?zojft9sH|(p7{4AP?quKAPsa{k~uHXW}sNir=V=dARJjy z^8buadNW!;SdhQL>wUgQ#?Te!$KaNy;`YD}X5N6L^bY6aNms&n$B%z-^AFSKQ2A8K zH=-%Av-j6#;|IRtBz~+Y^`jV#FGGrfkeKWxD8rNc0}#@yPHs-H#u#m| z_S$B@rDt0q)vECB3r)_(0G0CRM3{i(nWuESHLKplQvtW&zQIFA=@{vokG3k9Wg7ZO z>CK=%V^jr;Jh}l9_yH?(t}g|xwYjZ&*mgTRDV{> zcurdtD-bW`@KE6%0MXsPBH&GA9RMczAhjW{kQ%B2p8Ry6qhl1pCr!fwrkRimgRl|; zitmULr0sk;H%KWI@nbyi(;`6O*EPp-%z+kVtw6`XP7#$hsawn#zJ*lCgb>cH&0rsZ zy0&To(-)-y<+}$8Fw?+6#Rj;}0HL1W8#T*0NWf4(oAaO9+)?WbAP1!S?J%cOzWof}w zaRA7Pz!#+h>|@fSBf+JS;V>sX!09pqnC(bVQ7&W6bs*qKnC+P7((3v@_XNbps`!M& z%yD*$|9fqY1M#1S1P$lgRXLeu%ED9F!Rv~3w!V>?;}tIWfOG?TEO+b8`IIZUBCD47HYvK~4Hr4mEiPCeY0LSYezL2lCr^&Z$Wn&+U7{@Ey#fu-I+85L5gfCjXm!7?#mDJa> zC|~5Xyc7!cL1mz=145hHTSi@TmPi(KI?KO-qhguo<0*IDfXx**tTnpZ(Vv})cFEB@ zRfZy}asu9&He@57ldt5)wSum=@CDLdhpGgu@8d0EVBmC)BKjaBnXk7ke;%4S14vt* zfXgLys$vsRNb?l#BViPsabd!^rTXgF>PKij(g>1M|1ciq(WX&TBw(0O5F8Qvanq{y z`{&&>uh|OWvw0|BAOZftLU&fwNTWVR5~2Yz#)Z;JB4vA9#{%o%m5xATtECLp5*0E8 z>CzQgA9gEs5h{+YHLFdbM&I+m*;rx`r&5Op5I8$y8h=X_s*TKl$~5i!DXy%b1^djc zf7iG}P4wuBsz5g|@D{L7$x*$L^x?c0>gVst)1|VS z8p^R;EHJn~(S+!~h-0{zg9ZJO0b9-E;rp!Cl%D4m3#?vEiqP8NOnP0NXmO(x8;P*v z?W|*#dALBc!<%9lRX4@Zk-AJ=~bsm;0LcBdyORq4`SQdYORj z&@6)XT#EcRufZNC1UV_*j|@A2X4|IufV7da@BQU<|L(QV5lB_)wY6QA=y>f|%LdfG zCE#w{p8L42FN5^nX6G6Mx!L(iSI!lC=P!H(*DgFe^s^t@ZiHK z7$>N}sZqtMY=lPeXpB%}nW>x-FSCl?bHwshWMZ8toe911;F>1Pphow2F~fLNH+qFM zfvPH!9^%H7uuM9Qz1^Cg)T7x--V%fl@1H|X9GOec0F=SV@!c7dYq%0#KmvlqI1xqX}*330&S`_Z6do@mjf~m}9hcXaiXyh@d2a5c}b)<0Njr z$UsOGV@az5YvJnAO146*zunKU}GZto@ieQg2uO7M}tPl)mm% zRHf16YIy9@=)yUiTg<)0KP#-kuL`v(3(sDcw8qq2ILymHHMl5@>nDW9%-IZUPRoF#cz~9D>UwP@J16B(le!0#SdcmuXh<1PJNRlbL+{_)08-E7wsuio3T5F?mi?+9KO`b`A3(6--Akv3bmg0vsJOv z3s2x#2m@DTDrkQv5SXj-&|^wF0^G?cc0)Esq|IRR$NQIHnjldH;pxdGZ|xPFJKy@G|V>>!tjfJ>^C@i-GmR|Qt;w9n_xSWTrz!J|P zl=^)OPB)UaG2WrL1CjmF7Xb%4#y6=Hao!O3x>UZCfce5X8fp#NK@R$0?+&W5Uk?Ll z5yb_KO|;rS1Y!MUb#1k z24qyk+>UZ4ezz^3xSF9au{UmA2nBW~oM_8wgo)NvFqUUr)iaN=d_Ua%Yj<=rx@5yL ztEC)N2(k!hjC6=BnXhKgc^(f6sH$H7V%9i=aNqeb_y|T^Cwt09C zQj4S*1|dBVYzP#Gk82MfQJ2f%>8RR0&s>RPvZKUx!h4$@OEdP;A|$g4S=SZ7vzKi-njJsR+Y-L zV9oG;8joL9Edj}d~@A80@?Ukfb0wIu% zj4Y0KU}qcF2*MKDPl$NRjKO`lynKBe63OmQ;u5ydV~)oNy1n=6SUhj_{$u7}yZ4Co z=U8uN{pyMZORaU@rWLGv@_2QGwCUpekM6f`srSDZ|E=$hSE~GhL+j3{ zeCIg%)IS8Mo9o>gG@e3GH4PlNIyQf~1yCDbpj_@o?ejhAOPjym`g%vzF10C#`9vZM z3LH@x<^PcLYT7BQxh!h-#BxG>8p;5od(|(PvkMg`Dw7u7H%PoeQ_?Eu=GTm$@(D+} zLjk3~V7gkU>#U@yMjwQRHl=V;zXffEK5d27>(M&A>@AX|1r)Qfn_Ic;<2l(;F(RB9 z%KEZ{I%h_ZLaG|yBmJVNw$GjDbg6q45!9-zjpZ`LCsqWWgijRTaq@ic0WFbJTvrax z6!gZHN+N6!Z8PRdBKC#WSrj`q)_+&Ilth3M1}Cgh9SklbExqVhoqj|6<`U3X-yko& zK%Req0Q=?|40*rv3Hs*d^~fvikW>7p`;ZzG^W+=!&e#9AdHMmeYBcMyR&uxdpPC`* z8kvW0%TCm|?0<7?ouqjGMsnPUvHs?UZDc~Z_yGA0pZ(zL=l>yyIGp9LTj&2-+xdBj zD^j@3AMB~wd}1U#n&ofXd^o}H3nj+e0Al@o1BawfJq?YBFw<_59LD)~dqw>9++3{} z_f>%thrgIKqTSgdBv{89)VRTk(Ft@&G>__79to{qGl(ch_v?*WWa&!bl7Gis+DGBV zhVsncWwhl5on1rlC_g3K>x#5)4i%kcNH^;0R9YI=zIX5K64qF=@DOm9asw~GT+0JB1~!M46jP-Eb_z^O6Sg853fm?bkUPMt`p(%wu}~g z9WvFKSStTWwc4S+}XST@&kVIoPzwxh>1rOC@1E*vZs>& zbRUB2C0=KICYG7J>7%f*VS!}8E){FRb})rUL?^Mqpk6bZ6$ENG!Z3_dP&)rt+PlMt zpsw^0-Ll1b=A4pb!IPZj=-9!D$NXEd^BfaS7=H)p7a(>dT@dpBV?g+FP=D{T;> zlnUeboqTHP_3EJ6QCQ9oE1MHkb6PXm2w9bqzljtpe!EyTGuw-`d~DU;vA`s#9vZ11 zuQ^tV7KakpjY3Q)*hGZ=e)o1peX#raIlRaJ^VS=KZ~7iVr2?yaT51`U;Tk*^gh(Wh zlatWkdv*(hn}fKlQo@Rxqo^YhW}bB20yjIihlwTE4>f??a?puO z?!63(C5>Xd+8i8wb4tlHF9k2D3^%{J1aO>y?THM`)VFJWJJ1Q*DaQ{+2}#llky2s8 zy79)ga+^Otje&mCBW=6};=PIc!+hqi&y|CM&i0fM81v3uXle(RB^v}zfxVk3p#hH2 zQAKF}l~!Mi_)mN99Hg{5KhIvkqA<_8`JOhsySOdpcyOa{y1Xq=?H}0j6syW|4cl_P zEd}!id@AYk-!cLzJS{?P5kD1kr6r|$f-@*k``E{{&ETlwQI+;3j^lB;_O_oSiG?Wv z#(gG8EkPt9NfK8tI}XK0!jBpPJK55$4bzgXGsecnOZREMMy%sL%S(=Dz1kgHw&hOJ z(zm3oj>{R2EHFShwy;1dhqAPf@GgXD?^x6!k#A0(J2b(3a)p1-l)(Q^d7D}|+`|nZ zS>IVCJS^*jDpf*cTT&x3lZ1;0DGm|P!W3~Tz29!Hdrz4lVbV@{y!u2+IShz87~=b9 z&!4*HAWTD*n4$v{++22mcQ6o~VJ8ar+BlAH(M8yV!|6j&?+rpUqDIz66o7!fZSZN1YiUF8n~f}sj?eNX33u+h>#!j6PV zM7ppbp&SH41FI0`O=8KHU`T|a@#zos+zG%@#qh(IXbb_|p~fn%g6*pW^b_4-U!boT z6nSaltU9nYj4%Kqr%m(@bQxGoYfpl4=Gq4LVHsjl{8VGh7>qK9eTpIsdCER1sK8NM z``AZ<0F(eXn-#zsx%6?ef4M@ccxcF@Vij=a6%KJ^Dov3h80f|bIJ?^tmnb2%cAE+} z3F6C!8FTy`e&sut#Hwq*tR)|f+Y2PvfUvuRr98UPju;6}7qfjN;d6>A^_ulGKi z-P$(@W2526S61-<>)&p+1KR!;@E2S=^KVN4Nr$bLrMM*<(%4HT&&_%W=a zcIO{Pu$xdp+vqjPaQZgtGD}|qXGhWdFq76JwSl;sb)wGK?(@91VQ$57<@#m@1$u!~<7LC#ufC6YxSvE;=Coh%rGMrkxs>Q+81Qgd6#NzGakz&aNvF_V@T|%WD&}M?vWP1&1K5Yf?520tq zgnAXXak6~l?RQAVu8g^3e0>&9^3Wk6WxX?LSq!_%9dbHMS3$~vd{OY_4z;M4jl7MI zvT8xnG`wUL(*ZURKvE?K3Gd2FBx#`p-{;>sQd90u+n(k2u($Q8i=AdF&g-2{6x+ZK%P& z#bttjdp}nvAr3DZYN!pIQoPGf?CW+_4EIJ|Pf>3ke(Xy2jw;|1dOlx)s$_MCxX6w{ z!&)F_FXAzNLEYw5fop@J4@3ay6bM1z&i_k4m%($ z=!$o*T#^waV?M7H@9l$0V`$nqm{$c77^FRa2vx;c@0^&^Ti)ByEE#Prnb)~E)la(f0@tM-7>OJPvT{p2+RC!Tj41svEAcY=xRo*OAydc1bI()Fq%Hgt!{k=*EE0fwwG_d$zEcl_ z&4UED8f|J1+yhr%ksvAmsr~uP&9_>KCpL=awQkB5Lrm_M@{Me_dw747G#(&%h+Jyy zV?PRQae>=ha!(Ln7x@RH82L}93B%DycmCXSv^|y3jR8S|w)iA9F9bfei3vhPL*c~V zk;lNOX6fNclt-6`alKqyuVUV!)CMueZNZ{+UkK|;rDFr@s%TzL`mO`A3OOd##Ul`a z(DST~J z6+Z#f=J1EYTnM;uJrgYNkoCj5IGjA2fsek3MBu?ey_eT%`}4F?r!=dXw@z$UapzPd z_|JiGwg3|rPs8;C=GY6^(Ej3NJG{!6&j7X7Zl;9Eutbjwss@p{T=ngkA5o0cc7po# zN|QO2R@FY$5D+FvTo-6ayi8;Qgq*DQZO4vlSqKtsl107g6Q!IJQb4zwjQpQQ?A z3O|_Yc@$*O!G9xUbP>GB)Ln!xSP()4^D?6e^cY9*e^U*fti&KbpkqlIjjpfD+aO&4WiKX~(v^M-z ziLre_;tzDr8RNLr4_GOA-m&&scu`5rFNkNGXCEoOPmYTeqAfN>`@^+i=OgM#R^WX- zPJjAh262afXP{0e>E_Rx*gxe|XjYk3vZmt($m+?7z*$~)DJq7jpfQB=7zA{Z)r5OUwq&BG}mx-HaIZi22B?Vy*g!| zfIahJ9 z@97arp!&bRH*IILLtNE*3#D+_qegz;>G)1xem=& zLK)NQW*ZV@kOOjKa0vyeErrV%q*~&#CPyN#P=he3AEupDk1@h)6^S)f% zWOy9&%$7@RvOegNth_|aj~vAVtACm@Wact%Psi}?S7Gk7?Ba6)FLs{hqYgb$NHoOz z#sSt)W4n9%&5tbetM0B5ZW7G9@DilAT1FNw_F|oYz#MNiv}7#EAVG zMU0(%JqLh>tlRK5@GIjo@6@do;<-eX$z`P5(2g@wwu9OvRPu(yoR>1Nj&m_4a<{cs zQAYhQLX}xyL|2GR*c^-6EEhrU<_&$MB{A9@J|5Q${!%2cQ5I`tX-O?DR7|td5mrdq z9EeilX?JUt``)CS;p*O;MqQt#Q;@^2 z9`wbKW-VoYFR*=g%fELochS&%u%W}Q`)2Fb?5Ic9eGRbQ-=FCI-oU$k2dHRO{H2j zt;VkSPIXatX^3OO!+7q`^mS)gqv@cmFl(|F(*s0w6%*BZ6J>~w$@wkZ$c-n^6R_5ryN44>scaR+*yf(&ma5d~_NK z$xsdnPw5T}mnnxv@qg4e0p9O}AJo>N=&T{sVjiQZ=sn0E>gWSR#v2@8rhlk- zfJ_LES5id@E2P7zt^T*Zo2aNLFmQec3uc4rP@~=vqG4d~{htCaK7Zg1wrPTm!MrBF z!mYVH*0wDDA04`DjHT#nPw>sjuwG@z-Pems=x64u)_|N`FIDP6K59dm8rfIg`P(Ki zo0a4hpVJ4I!u&uz9ifzZH!-mz126nv zrNVTg@=AKB52fh|E%F_}UO>kD>d4b|CL9{@)!h3ficYf#j zcS?Pk+Z7^nBgf+(ra*%uU7`~b5UA}OMDr*D3?Cb zp`5k%tL|2*Ubx!Oi98D)Bo{)GGn9?shZMe7c?N|skt7s(Nz$NS9u49%eZ{!mI& zJzBk4`a?YN4uAPYH6*$py2_)HT~2|W5r@#eX=69OYE=Q`L9Kl;{&C#$X+r>3M5PJd zXM$V=)$EixomZ}!QnfM;4qJDrd3~&_F%h&mL(qGX5v>>4^#E;2vd_!VnStUX7!Rp6?MH z;29*&!_BrT4`_1%M|q_o9cHxZ3A>qK=*t!t2-AwX-ZA!cP)K6qcqNA;I@S(e-iZTa zcA$d0^9&(smGg}q*|?2c>lc~XVuiNX*Dcy5TbG^X!NAYW9*P;CF za1v<#-Dbq`(e?<(q?l8ogJ6$-(tW^|p~Lc!vanz9D08e%NIuDPDvn7EYT-F^S3$q~ zG;RgXkVCfD8lnB(S=!AZW@!Ic7`u!3uQ2BFUtuiKd0z-be~3oE>#jI()7Q1 zMViuEAqEoNnENF3z3!VMVa&l2R%fhx9Q#wmqX|#+rApZsjbIt|W3-;g-dwqEnDuUfe2t!Q z-CE8vx@Tsm*lMa3E*{|0ElchDT-IE?tyO#RRUf=zz|#aF*EMgPvg`$eK(;q_Zm@j7 zNld3Kw^nW0IU78os|I;rOn`J(B-UNa)D5O>;XGp1ePdpN=$iGDF`Q;}&jbWUAHuwQ zM=|yP3WNP}zjC8AnaB6vS}q3lOK&NxZb8 z_>)Cb4ejUwkp=L1+Tiks0m>6BJs4P>p*H9~M@0Hrj~p<#n9=&eu1<}RnDoF_SWHG4 z&PwYM7MWEnM0*(@7X~9Sd)68iWjfT*JX#>U6(-<*wFsiI~A?7}Oka?C3OJe}k?Z ztw3ZAIvH2008Hjm1L$AXD%}$dc`};4ZOj#SZeRRhxRdl9xXBpHMDthE!hC4iIV~`6H)~6X=9e{!O)A&hOXlJ zB_o?#ZvLeX%BP&c)Hvi!Y6fG<P0x*6uCm6KzR9U%9J?W}=TW}q(=V|Ro){M&{qaha1q z0P0p(z!nhU2g~$wdQjRJS7cY_=kmhW+lb`o>+n>f5MmLDXf%1e(*XkqDS@-@Ha0fM zLV$GTAKB|_!b1}wHgQydHFi7Hb%ep?avAM%?m1$%j?w@H%fr~oQJrMkh+_t3RiLSG z3YcQqKV6q__c(b;LA@&;;udvFeI5PjTvpPY^4VlC@f?;sU zHgzMfsWL%}g!4603XM-w%BftW2 z*anAh!eIaPw|>ud85_XDWi^7?+2E4Nrp>TdOaw$aEQEn>X5;<3joi@s0Q@F(ilFB} z8z`>WClBGhSDWAJPabqwul{{C`9AMtJ$oS6jKz`?c>`)NK?XrI!?Qz*b4l)s!wz85 zz4lgdG{1gn<|*ji{(zxiTUgtwp+U{(WZ#i^n|4)4?tXmOea2q6E9dRxeI=VxQS+P^ zQIl4Mx7A40!9w)~a+=%<7kvqt#+9|PUx6%XqE>=$#*?kFo87`UJ0x$D+kK1RB{7i6 zYMNck(Cw}z;Hlbz)AxC&tuS-(E$x8v5Sv|n;RFwnhA)PN6!MX?XK?6l8gQflOwyUM`yMl zvkP~iosif=K6>MF@yGiBa2Rlj+mhKiihke8S`OY$MpFVFL7&0~mm>(4}9XVu5 z#l0s&`3U6r%h%lVr{ib!VO6PaT*EA^R2(HX3o=QsE1 zW3H(}58m3~GXF!)iFibx7DLy1MUHuRqXTV{8IvylG!J}n_hI*p@7`Q=C*2q)DFshO ztxWE@Mw>Hao$-&!L%(Xt)N=Nt#GSGvhk`^c+>%~rIQpX&WJYvnVmd#fKxz-9L2wp7 zy3+V#<@+4(R;qt?sw~APvGU^%36ujSuN!LE|xT z6i>RL+&_L!!y;qMH0~j|Yd^{mka7%*LQs=L*gnbj+o$-9sR>gXAEr%!wtb-d9hBsP zb88`2T?9F6xDC(pK_b{GWk$4_c&$5IMLXj*ftQf=bbEHDeW3H~A&uxZQOQ)S-$=g+ zc(gZ{O1-^zupn#n#GEHf$47|gNlzT-RVAaO!j0*b*L@pCmE?1C*32L^C7RDl&23#y ziKgVZQ`+*De!Sw1MJ33FMn4d~+*;V?{TGJ*tapktSX^%lZFfruEE8GCqa~Cmd)>@) z4~5Fz<|})F{+~t?_rD)@jnZegfU#LBKBtJ-uUs`M!T&`lSMqZDB9v3{rG%)c=%Hut z3zt4a;)i%u!0&nBO62`JVb!;wa%HbNd6FS3r|0ta5QI zR>ZmiKM}JH&QQ2RG2>f-5Y#b2MrAPpB!MJJAUfwjPmiR0svqMnqjf@*D1|7P4(D6~ zVVAOa!;-?qGXzC|h`WfQOgnMvDUi@KfA*i`r&(24u2uRhLDvpWCP7a`4Kh=h9r@Wm zneT2AXG5oLM@C+;jP4Rp-(f2l91|c+p`ek|>2!RFuLvTLwey&kn;=pCB)>8xGZV>1 z!ZK6O`HUfH7(~P`UifB63>vxJMi65v2W788GVcYI+PTpXUtZ{Mqr$5}L30WR`#znI zwvTc+KPyQHmbllX?U^bXaN92;wnXC?LSZiy8q*{-jg`Ha#e!sQJ@n#di$#x5mx%3a z?m~5)sSM89&o^0}gEAXo^KQp=b&xwj6~6DEHWZ8@3!ftmzO<%KW0J1TPnK zbyQ@_Anqa604pVab{Muml_4lc8B$mUvM(2EV1bfvErJ583`XWD!NZZDb^}Wman9I> zGukRt8p)Nv=6vk?)zfwgVu16b17eoPTW`=w!_Mr)aHc|AZ-;v`=L9OPKpe^OD=gJB z-8}b_nx7``-#cA_YA%%nOb^-p&TU&h90GP2{MA)1iRS-=8B<^k5}C(xAe@QN(X}c? zw=tB$?0Dp@H^1EYl^Vf!M zU8Fwlf zw{LKDabK9^wGQnKiE?w?BIkngut|WLlPNU-)AF{|`$!*Y>iXI?FRGz0w|B~OnhaKP zUsew)4uSm;6iU?3R1#g)+pnPw%y4husrIx!pE^j+yT12!?_jvfU%9&kl94uSYrg}1 z>=aF~_|VK=+u7DKMppwj7uu z9Ymct_m&URUKEUhI%r%%gZHK_PC-fAlQr^A)5=j#NBQlqVhgG%Jw83-QY(Mfi4xZ7 zY)=+SCESej#|V2kreRiF(cmv)cS%I~>lPdd!}viA?JlhT`)ETbE##s5POikZW!U{Y zx{WC?EsJS$u-0Nxk@qxJn{8NDZI(>mPKkS+0m?ZSPty%sbPJqoBrc)Yi}z(SSg$+O z@#*_QO`zklRwG3C@DHt;5bXmg5iAPm6+-l5U-vt{-2Agi>?CF{KQNHbD>yC9dXi{x z=xV9mcO*PkzjPKt$G{;UTXxoqe60RfJ~SmLwWtMeLL zsxxO8NWXJ{eehC>$riaa?|d-iBhH@;6DDLY-nVXE5Mi)yRJNIGEiah&Nz#6ntzg6o zXdrV;(Rq*~MT}`DZQ5wsxq6vxI<;%6W!8VcF6wp!fg{Q7X2=JWsh}#Y#t|;I)(d^~~6wvdE zNY&i3CllMLH6)@?XKHykY&%AQHjED2O7b2*!BN9gPk{HM7e2P+DzkQT&oHA073#nQ zWL#C78}6rsC6&OTWM!lbhE41xfsmJDZ)dz4v%=f1(R^6!?edz4^5-_6c9`>_OwlDEn%^IZ89fe)2(6c56Ghx&omQx;3 z@Uub`20b?8ngzytLZU5-6KJ(&Fn3#65ms5P%+-%6n_3yFm7TU>YAfhj7Ll4|AKTXeUPxwE}4~(-sfxYil(Hp+fZ2kUyg%MHgJ1Qx6vQHK{ByxV2NkMrP-!%n``$&#Sr9)n{Ni)17=v&?uHv!t0RP+RAxYOgL^K z<+~VcQ&2ky(bAxQpg@9E{O*F)bRYZK60I+kGdqD@*o8hj@w1tO{CLX#dFD%O(>$O| z01kQt>_tLORj+RocnKpljd{n)iaC8o*SP|zpb;>US(oZ$Rwl3%nKliJ(wu5smb4K~v7Q?aDTM&g z@3;}Lh*-#1jzgoItIIzd%GP`$B8z8q{q=6Azo_^7j=P=ez8%K{9rLk+B*eSB7sQ$^~GL^q%aZ}|^ zt>unOVM}XSrWZ@xnTauc^eEm{ja;|$U!CdWqDC$-?o8!D&;Qdqvyv;=FbpkANHF;t z_0{9fTsSF`rvv(yJyb$_w${$51V%+XF)I0=-=grX5Q=q&rIjji}~eV&#v zS38i`#Re`qaE4$1{)OB$M8bB#F6Xn55kbv3izM+3b2Wwx^PFw%$2DZD3Xi+oz>!WJ zVheqNosPgo>EpL4L2=oAcfTPg!PfKKPatxPeik%bWX2h_kBR^^aFazXL4-HcCaz}B zq<=8+w>5}e@t6IMKCF&>+F<3B@c&XEYv8TcuLXU6n^C;zLVh%|m8b|9Nq9_bp6^Zw z%7_7(!R@L*!u0pEFnDzsHVj&jj7o46lmvT7$QbTJg~zl6Vii8kq3TE$q(5SF<9^f# z6MnUHA~R*Re7m}$UwUAKwXy=qWCZbAd4M2SzWzXzx%gv>&QcsCUs$w)6+A$FcreIb?$ZU0=ETza%=i3er+4jy$K+=?B3+D8bM7~597rd zn5>hwd_~UaL6xB{+FeU#`<2@wfP6LNm#7HbBmuUQ!g&8`ed z2fMHMU-+AdXAF@dXvs{jAuw zY|3~P!}wSh_V7MTQ)Wd?DD7*)H72HM<4`;`arps9j*77luLvF*4jMv?w+XB0WUQX& zx*SaT`IqQ3>h1gCZ)WYDa5Y?V>g~-fHb$?a($hRlDSrp4gF&2{X#EIAHbkmsgYUEnE{40r(=UA z%5X#RjDQ*#fT8g~T%pQWoJ9%r0kPAT_8#Iu`<0!d^t}7!dJZJUSh2>Zv~UOP2sJ9n z#geJr;3eA)1)EcSwWR5&?Zd7Btsj)r%6Eaw*f|Pf3x<#dRJi~_TB@3p^*1-gRx3v2 zpg~Xe$npfunojwffpmTS$O16&FC~@u`)^7rho9}}RFr;S6JjS|`7B^p&H}>T2uTm> zBZ&)3ev&Z$4)JeJis$MpC*_o!;D?J5GWXKvr>`8t!k%DfT5)}}0CvIF(@r^xPUxBD z5PZmuJ&zOU#CoB|xq&}LZ`h2@Te-2uv{BvN1GO%@vAJd4D$}{P&A+``ZCKIV+e{`wz@mWryXlo%(J#;#WXpdbsakCeFyq%d*j=cwe3YX4MJp>caZ zjqEhZu9>qRG3mrViB=EX8_btPE61JX3GL;Em>kJYZLF|$^-nf=BzcA9n=yU|V*0*R zMI8*~EN5l4bM}(jlA!L0WVNVE_*I^T_9PIPajk)iR&~i*>zk*kQR~9a+E#OVH;ruj zQhHu@jm&HfH`K2wP;0>M1()uGRsC|#R{;UI$t@cr48BXPY?n$Cw(9I9tkQW1BbK4B zvUUY36ZsO4hY%LRYL&lN*B1_2<7^0Pa+A^036zcAB7#j9K%1#OP}BQo1<0ML6S)NY zo2T*}-0|ulyVDhhtN^$sSovP)w(XhN+al&!pe8wZy&lrNG;Vs6)x7XtIF7N#UNgDw zDe=bQ2;b3VQdU@CDl<3G#=uy-&!Ids_BSwhZlNPPUA{L6F5%PFyVjI3)dp(L+)ZNb z(@Cw=-5g+3$Od*uM}$AAY?sop8m#sDA#x^hpB3Y z?06D``$>;|(NX6*z>Tgg8byH`y=sVz{B;sVT>X@h0xa!%xXtuZf`?B}mJi^VeBavk#! zo%u*YR=sSx5yWUiLCwfQF>^OAQC1;g64nS9iy*Nx8-^d+vyjnPo{v&U*f1VR#MR;> zL42w*Wz+R2e=_KFlbvp-IXtdNN9uS3>D3!j>mHRkV5UBraxW(?A zsqk|z#mYT4g64{22PP#HP1|c-7Qi?z*+P`lXuN2Te^3@zr*%{6PbTau8T6@(mpV>R z_DPSSoDVCm3ex)qq6Qa~u&l_&#s@ui|;66ERHbxHU`ezSw7uq!=d?A zEycdr6lj@7R4qeiviiih82d%QHwMDLw|{;aG1-6O4mE383KeAL0&dT~X@2QN#(?ZL z>AnvfTfPjmgXSwP{|CrVhR=u=T#@mQwZv10sp+*-D-GA{#iV!8$aAp*xLyK&v zQD8b5tsTp5)9{f^mX1CsrRt_bzR!)2X(9+~uF_SB-O~|t8~gWI;{8-29)7JqP}f53 zWhNDxbo<$h1ucZ^Ps6ge*TN>X^(b9Ag}0gLEOkgw2U|n3e^Sq1LYq7$15#(%{s>c9 z!Wz@M53U~0R?3LsYurE0?IcJNi66H)sf>&Z%07PaZmGcvlJJQoib+f{a&8H#oYN8C zX@3@-?>wMH?}8`HLKAYV4A07y8RPEei#lbGY(JB3yoszUA8U60mZcC@DpwruI9+35vLJ zQC%}Pv9P$Y2wSp+thg~M#yk>Mac4CNvy(`O7-BWPU=ay(Kj>j@Z}GofwIs|vNzUhC zQIo&^O(T{3GIzaKL}}`B78y2@4~ZF_{hD9?b&~%Dp6MKfMXm1d$~>Q2b)rS*!w1ji zBXXnmFa3>%d~PzKLZ=Flc+iT=YjI*@MIvcOAwr0QyjZP_x8Cy9m|U@;%T=Y2D`}4n zk-OzsV2F=Q2TX6y7cW=FVoi$|;wdrGC6Y9seqk}dIuGcX?;^Zs@QUj+KCSLiJ+mmK z5@ZOaRs}`yq4@5nu1cMdeb$~DFprb2(cNYsX&9~CUO`>Pl*Z%i=k+0&BZ&+c+LVoV zfCkw?7sP?ZoOrrbDqaA&w${=DPlklKaT@07Y|lWt?g|Q5B6#eo^o)m#MbOd` zyHHsmLTGkuo=%fBQbGos7)kRLnnzQ>hfAzwI!Oed+6HB>jhl-rW zLBj26@&<{AijXorz0=_#=L-{i;UV7^S1E^z80)PNA#sxuO9m*!I!g?q$b`U$&k`Yh z-9sXz|8)=F2Ze~&=P=LXApcF*`4^81)BauZYrIJ|oCRkDGG~%T(PYGMCyUP{&6j*~ zTVzUNCE<@~m_8xNxAqT057?zO^r!OT7~dDqzA<@z6~52HkORK+3x8imW<9tON(v2< zV*}S&WT;ZU;*Y`Lz`O8U=t6PkudP_|D3s%9$(h0nB zNgTd68sn44&GIRz5mSZG1_oh&TfpQbyZv&LHBMdSQ>6(up|{}*QG94G-HE60lpFX$ z^FTXZ1*>z^PODab5Ud|E6lTWzs;@>6P@4KGu#^dDlu^iV(jMKKA?7ocCS_$#|2C1? z#GPxGmpxHaCFEBAF?gTwsSWe+L$VKBdY#o&6!2A=*)-IO7O*u5x$XwvC9RhGP?f6e zO1VkWYx(_j_t06e!iz2Adscl)+jqHL$j8W*t%CT5F||K&_7%lw{VRM@f{fh$U$znX zln|ERR^TI>7ES<;&vS5t@d_R?79tERx|FAVt9Jsp`!o>@nXXNI@=$U zBu1}`epq4WtwHfSU+ZW=#2-+#pz#8}LTAU&_HTRfta%3h#t?52WJWrt#E@Fs;I>q( zv^8N|SAM{}r;v!#zHoi~@5st#2W+++fo<%0dDG zM!^wX?02askxs7z>lgd{;h`Y6r(rG_3Mg#uBa74j;&&z9d@ZJV0TM!dCdL(RFckGX zzcHcGnLPhm9z+$p{NX8LP+z;X6vd2kky55jJP*k|McL=ucU6Sb=}!Tb0Uz*i(? zt{Hh;R?|JqAzF}dVKBa!0T`9B<-IfBuC~J+c1b)Eo7Sinn>lxJnREfv+PYvzx3qU| z*rdBOo@k_4Yx8=>j{nKbr-zf`QQ8V%=h0n-@~8%)bmft4oC926IcK>noL}ix(T32`;jt-a4Y^a? z4F=~08)Z?ad#hLZ@%zA>fjcM}PcBU2%b$Gi)t+n!zs)=U=Gx!JeScNuXUr^-i0$i3 z@wbp17XdTS!-xHV>^A;m5rzdPgp!K9y;fn!)1T3&b4LLpANairACtW!WLD$bIp%-78cd+Zza@-u`?hYYSOrm&bP%{S^ z9rOGNg7r*|JT!1c0yiy~=~6O_<9Edw=|@J6De#dGte0w!NocWhwYAZ#2v1E%>|^Hx z4;Im>er%xkr;loTN_V7}XQ`%fgJd!>Wmbw5>=R5Kfx5Cfs`{X1s)Jz6tS7hA;H8ay z67>_`0+;PAVzau=>LCZiuJ5`rbeOHH4eUbMC<7Bz1&)TNS(rn?PI6K6TY3Vr3tUWp zF(`_Vm_2HgfnrC)uXGwk$aHwVqai3ah1eGc^`G9?tbZ63@+#jl7n745Y&Ob)<9umK z^NneCLavfrRBGwQ)E5l(_ki%ppk1!ESHyHU6GM*Z$>8kY2~n1FI`>&{6I0>w$Pp;O zOlqYz0ZHHTgH(u(DOSq&VAy6_E&ePTSAP$YN+NgS$@$fQnf2jv1fnw(QdX(V37NmU z>vP;r$2Vp4N@+^$#a{ZDjTU7*>U##F9a`rbLUdugJv!}XqgmXZOq;7inVvcx&fjR* zn+S)wBMoVPcUtK&ON*S583Eov5H?alhsetp;8NGfzYVrZH|275vkZs3tkD)dvqtOt;yVpQ zYcrXLrP{Id#Jz)q9<&a8F@}mbpZ`XYDdV0H;*Sig ze~{1F=+8`2c`-N9l3g_@sS5~2VlFvWMG^28v-oz`$?H~-@|{eFG3?;2Apv_~Rjxfw zx~^TCN#W6QchBQ*m8|MX)-aE$D9%7e*(<{|ky@$;30tchXkO=`*q=qW^8bR&L9QkC zC#qrt;RhAb2iaxO_2F(FpYW~bJqdqu?Jyz7D7iZ&yx=+5mIx};^BSKE)>)uVdHD~O zcQDeyScqv`!*0-2&l@{{ zgu3yMWTXsB$Hc?hWx)JYvRf;TLDpYD>t5dRO!|(lPJKr;G_8iNhq7|p-CwAm@`qM` z3Y^T@E4)^X|0z>%NO~yi#5kN6+h8}hO?YrL#$0ZoCq93)cBPx)2!lVoMQ5ua#5Xlm z8d+I5tjwT?N=v7~G!TYRiA3haP7-P-kB{k96~UXP!rot>(YeIh@5kqfZs8~$4?NTj zy6d2HS47AvSasa#ko8BV%TM&UDJf=M%@=??1*eLxHPuOy)&Yp`8B0ZKGFC%fc&3v- zBS@*E@<+a>Ew&jvDXKW70}_TYc@gzkW-1Z9&Cc`rf8bc=|Jdj#8h#D^qMFy_6Ftun zTQ6Ler&G?Y$}jjlOL33>VgUK1H@>4(7eLxfFsuhr;8*>W{Ux3e!zkB3gcAD4g*r_M zzIjbMv-^L-gwkDd-%zeZzgWG>>mH4?PCP_v$Kw~sn(sXH@eU$Ca+i#xN3UBfpjza! zg&$kf^6^e$uQh{JeEO~G=v+(q*UI5UFGCrIO9~bE;X+0s2EEv?1c{>t1KMQt8N-*O zh~_235Dq@v`VH3u#&NGEcc&H^w0VQp4^EXapBC8Zj1r4GgtKFdthNO5N+7a9l8NHF zekvU{99@6*K~y!-OT~PZJ(0_UpP{nUgD?T^J#=0J21YZz6fh)N0ni%7maVnv-XK!W zoXxe0!Xh$pfcrsR;kJkeld{ZB3xOiyzha(hrV;Eab_nC(PjyS zUa2OgiL=_SoEEu6rn}N^qAoV7|$s05D|iXFti>>OVqi< zj5uovs56m~W44r(d;IBHiavknKmJ-CLDTvP`p`gNEyu5ICKOv%e6L!xA`>^8vVK_; z*sGyN1Ez5!H+zhlIp1prqao^PnNoAl(E1{RlPXq5n8k_*{)9G&ZDLx%P@Jcim(=#r z2}5>z*F(y=imKfUT*X!kbevvcq$Ssg3OGk`jcOb_yG$x=CE>^JJs^;~5`W)wb!S~k z>IGZNjF!`&8_7KB}qlU14<)>tT6V4wplQuzqH z?8WtaRiYnSZ-Oo0-g`HWI)6)mRowZKtw)fEWM-M(GfgPw!~OC}IAAoe8_DCFqz4wT9;X8itV7q>acLH;i^drE@Y zEE$s-pSW8Y*dDqb6zFg;$B?p9VV)F)E;{xC!L(O)UQCpXCd!vyKK-7)dp4VKXGh6Wm z!cK!)Zy0vAurQ`K!*IWUxlacXV4Ln(a8#LA?(A%>X~#jWe{th4|8e7IU0=O5KI%SP zt83OQ;LKTq*HTI$Mn=orpjk4A!364gl%O{~%5j}ai%4_{JHRzASuZ8w1$udQR1 z*J$KToClMwz}zg>dwf^*-%>D?0~0EUdK9?RTiG#HAcT(f2XaP z{L$^SaE0j3Y5spKvq(=u(5rqnKRweG;e_!ZAeeFUUA zrwV+Vl*}d^89-w@-l}vA`Gd_=YYY#zZAhtC;rO86kvgQX%t|3aXtemcwWSM0Gx*;A zID32UMZVZ%dKDO6?qcXc2RjX^J1a`ef4%l{b~{INzyNNAPK1uHNw13(EIIK5OaE=! zN)C+$X?2Bu_}4)ykj=L?PZ6sN##I$DC_UP?zT>REQzH3vF|U*&8*Chb1K6~A7b9iY zBe|MVZ{kP@!lCkrR%w`qPZ8CK8 zPJ$~<{ z*OTMVI-hT1+qO;GJPaQ_y(?}^n>*h2-8*OOdYhNm?AQ#iZ#zxv{1LtkU4Qx_^`CGU zuAW?f>jk|{We;z|nEBSOcp0=0cyE?85(`^kULtpqS;+dM6d+^d8ll7R$Q-H+gAS&S zg3O81LByas*yXiQywf>vg~F<*Hvd_8YRdN^#Ob1CZn9Cp`AHg1%^x~2v-k(RL{knt zRe5&ZmfG}%XFp&^aUnet?kwJqH;*Hd?voUUT*a(ex2`89946QquKvHpi3Nu|4{Ydv`?(>)2R zOyQd}oB~l9{#0>oFU)6S8k;sl1V*X5`Rq?_;6teLNKyN9^v}NsBy+AZ?}=cgY@68~ zGlJ?sSO%ZKa9u(gbr_}f7V4bJ8l+;X5A!+j&lk^oW|ou3!_nNT!UxZO$X|pM%w(;< z6CffH8D$JK22%S3PDKelf)rHvW1#UYVG&qF_iZ6A{)V;P1!M&DBj}F$=THi=U_bTd zli+xNq=Y~N7}ld6IHDjyJ0sc74zd!nGXwfN%3qIh(Yw4hXa{bPvx_ih3Cwv(!cBn0 zU7Eg44RFx+kgbr!fo9!2emRp|C@bVpW-bxzSj>V$RH25*BV@f%82b!IFj*+Nx*~Dn z>#sZt$p|kKjlqD-hRxvopws54_O@al-OTJ4A2n*Kad@R1DQvCqR*b9p+j;v$0pCzg zP?|E1>JQ`e_h6OQ*AG-Y^+^?2C);^2d@M)r00lROOZEzheK;c{QJpN$sk2o<7nW)& z%8unA3II|PcZIX^MO1;?ak+0=Ey{^luvv zO*{dvdq~n*@Tha_Q4zK~ z9Yk5ad!R08`Zp9F5kBAML*7t+ooD_A+L`LLU^C|r?R5a_Nt=zvdb^&Po}u=X8?Vl5 zu#g~?ELO^?nztz2V!O9$T-Qb60%__L>jeA@QkP3K&MUO1kYR%s7E>zH3Omv51)WTe zwRBriQs2E|lmewz)Q4?xMqqmfe>jTqIAgJInPfjD6sbJJ%|;&@r1VT>(Qr4WuHCmn z)APq_f3w)uE#(RXrUsUU=ivDIZGy#XL2H;|ZT~c|iu(q|Fj;^iMrY|B@5^NS9_^`=K5L?g=l&F~~#@ekUpC zBYqfdN+92vM!b&Ji)wt4d7Zt6igeZH+$6Lx_z1ntZ!om66ZcxvmKE~L+66nDDS9s3 zsP}NcvH)riXbLk^%)_^3)-3+_ee|Q}H@AAz(PU2>qBK{5s%OsWIKst)XJm{Co?5iC zs>Eo!c{d(MgwxV)b+7-ThR)GhWMS}#B*P3GbwjvBvDk4`4E>7g&7*H)?;+zl130|f zjBM|4^oY@~P8)Q#M_T#gm%RZ#e(`@IJjo4&dO!C@*YLX5N%BB^gz)b}elT~S<4bO? z0&Zwr1D6a7xxCq1<7hR?| z1!TQk7H3DRzu_>mzt}#8Uq36aYIBtPYHRPXR15!$s+jc8*9UQLeY$To03o>9-l>ib>$%d#3Rr&CQc1!Dnw0x||7 zTo7?S04o(2>cg#VyakN^=rvr8Kzv@*kPCjlcZKH<=|_%MVU5uV`_y82xz>zF zIJo`QZ0M$tK=kigY%6a;auw0Th`z7QBqi;N9@H{o)D2|oH^zZ@aB-Sy?*Y$=exDG3 z$VTGwi#9i6j1j*A6+P1yGdW?f4Z^zvMZ!%{MZOL#X~!zze+ly{cr@=MkDa#k_t|Vz z(MF50kVW(%NHF{J-3n+UYS->FZvcMkH(92R=Tp!l;iq@|QnP z4{0tUUL*!urTVJ!cP*kG>0>-NDsu(ZY?i-BFTqvN&kkM0rIXNMc@G0cdc}PF7jfjn z%R#5oeyG!v@gcoQsOFhO4JBwQ-a(H%1AO)_R>^n90`B9ik(P4qyqSZj5&4VNV0@Kw z-T-T^rZsi%gN&l;r_C5*NG&M`iQ=%hCkD~P?{wkBMZ5+s{aYho2rVxhyvbofzO~{4$mtma6Z-cGy73L%e*S(yMG< zu)4ft^NgNui7LOc(~v#?mC`4fXXJ-~HwOfo^i3YhJeoj9ljMoueYITsneVe!+Fx7X z43Uplh}qu~k@pn;hLt(g_`C47<4*&vtUa>KB*EBtM1U4Nzx$*LE_lbggC3^?Mc*!4nUBhduY|RpOA_d_c;9!{fh3brTP>9xHa;SXwWW&;o zQP}(3s+h~}kNmqT7x$9KWcqPk(AW`@v34jvKs;J)zP51PwWN6I_}QR*KRZ|2w5YggmSQD2v>YQ)rg~2F^Q9%5#v!t2lE<{!>Qz~WetJ&?Rd+6Ity!?K zWOEXS*}&(cR)OV~Kt8DUrBVmtS7;Utm=Wrcrk~!jC#36`U^fw9TCz~i&>XR+DplQo zQ!q}E#P^ZZTE?bSq{<`pT6k5AsRNfuf!KpQ5(FV<`_WK0*+tFvBVlUj%HpRnl_A>? zhbf>$(TeoD5eb6WV2d~U0c_~&XNn(21fLFx$UZ{Qx7TD6-<1z%q*wZ`ThB#?Y{TCn zu*`&rxrBOH1aV!PE$P9C7?s4^eWU_2Zi!Bvz`3*gM0-+&tG-!YXtuG-tzKmQa)hfh zZ0F0>Q*oU=?Lsc@mh&?CPEk7#?M0}%g%^OCt^QTtc;20i-q4-wSkm#<2?Zhb*r953 z0yz))n4V6|g2_^mNh){y^`U3Bw3V;>{+H&<7aphbkV_<&hgQV)f4%D7gD)I;eY% zb?f0+81S<+>OiE|Hh%?{6kbU*wxOjnjrG(=30Fsaf&Eh}X7Ls#JX{g8w$1tpbD&@D+; z3JrvHTwy1Wz%+5lZz6?sykJ3X&FoUr}-;B)Pr?alBy@NN@VY1Ji7~(X9@{25T z`>9u_7sGhiHyDYg@vtul=!YHbXu?Zxgjs#sjk?pJc6uy6U?W(tUMgfV3^!op80hsj zu2r%9ViNBDwdou!drOGhYdtxzjji-y^ulaFGNdUuCV1;Znn|b4r#v&Eq`qj$sxB&k zSi8QD65f6;(I#;X&!9*ci&(oe8$j$0wr3DV*DWELder{Bl0sC zasCdwd9q>j2V&jU`t3ZH7ETuD@|(dH8ln;u3^@4HwKk?IhNcHzADU{Ebp}tiEr~{k zA_lu-!;XYX(8wdnj^iNCH&I_!e@#rmCSMJHIF(>~dh{l9;jgZPJP5CXgbi8V*4EA4 z^2?$t%gGur+XDWdP-YC!K&)kzorN7y}n7YHW(hibOdE8roW9m;!VPM zx&54>dT{(hs3%9pqMZ8Y@%o^4Db7Y!BX6_4l^e)5mGbSOl1)(~Mf-bcjJ*rNKI!1& zMccQNh~%Up2R!Jg#lE$CCO|)IY+=Q0?5JA+4ye(RAUKL+7+@}p5fT{h$leLn!h|Tl za31FA9!PxXI2T(7?$ijL^kAu$@mE9h}6Y-_lxf)vo`4j$H#wH6E1w(`AE6BZEoSE3+SSqjcnRW~m7G2ey z?svy>xs+3~-Y2VlAq!Qsb;Rsb!}bhT;1$ECl6b|KyDlr7-k{q-w_wdn@}9mp3q|<> z(`084maO%a5HxHOc0q@wi8MZx@IcFuWytmY!zhp^beCkBB>Yh^X{X?xz1WsKQvhFI=xA49B z$i0neT!)1$WG_Wqbt=EEV)=SA{$K}4SEXLEH78wNHo-(Iik$ej?eu^b| z#TzNoMp9d7>Wq2K28*vsy;mDuVmaMXm`MB){UH%q<_ zvw0tAnc92}1Js*+w_0$!`D4vEXf3AgVt#S5d;R5A{@3kO(J~g zA_I@d0hYE2YDua$Ui@r%tAk9v>C>Rh0;$H4AMhb>{p zbWIBxMh)&SYb76jsEW1JG{n=dZR(*6}to=TAfn1&-_zr=uiHARiKL z$`Tu`dixlc#+}71ZQ|aO2uIFL!=AMXZDp31RXelc4y@<#dF&C(SV96wN0UcdPX7Y zv#QTLBE`IL-*!%x&?ZmuweM&kh2x0I4~y#-mD`+x#0FxmMZB}RWD2dNSNpBnu2aRiKJwscCm>~>#@lsj2zZV5Vaib}>h=2|rMJhg zg*TzU@6+j8GrBL4O+$w20hQqWy2o;f98acR-{lt~H`)}Q0_ zS2OH}xE&|CYJ$Yh=gM|6eQP|)*(Xl@wV%Ru%OzyM6PZ5G-5hTYUsW9I7QYrAd>wR> zrH-+ErNml>p7apqN7L+P_ijUwwPz(y5V$svIR{bl+ z@}d}t&G*yO^>4T(g@1an)L$Q(9}dFcY)M{Q?rm};2J>rSLT82&<^%0L&~LU(9UutB zioZSXwe@F$TWi}=2I~dhGx8Exj8~v>Fss~|z3ZCJQrfRhRbPL+4N+fPXa%i%q9aZ6 zgbk__HqamIBJ4+%@y#4#$WS({PT5d@tcx-;_Yb3FjqvgZlYuTvPYjdIkcM?Il_Z|pPXd2H<6WWPK}K-1Y4lC_uw$sYsX=gXhZ`SSb7 zdyCLZ3z!EJfX4w-p&w#|)uZS3ZZ#fGe2sSW($C0M#@f+bs8&jQPVJR8#p4{8Qp z=C@P13WAE3<~ZIP;(A5@cxoATQdG+5b=&-Tvcy1b+r9{!(T01)t^FGW7T~D%cXd?z z+ji9_3NzxH_O4>yLGz zPJO}-o*iYWnpCH1qCeI})idV3-K>PW#Y4|ruEVC)Nt^1Ab&>XR>93*yF?p#6VZSXh}m`g7wq`273^@bB|zrB1(pTKBrosEZ-b$x$2noqsn zba+D{nC_|&Ot&3`T^9m28%`!;&S-Bk?b6|J+@rI}KBwK@XzKZsuJ6tH4TWHTSA}4I z+d zjPd-D18wfUg?s~cD32?kp;e4$_?jGeB7%(NLLBZk=;y1mg!U*yIJRk#>TgpQ90XpUrJ8hH^}mZVFvhRLW|CmzNfwe61k>MP?okPqy9E5^6*472YXim+6V zlOFl^-~LVxc?979A$h6jIMJ=kd(X_fe}WEN^2-VbO$Bw7`7%6pwZBMO9CwX5*zJQBsmkn$>G?b1w_naLyqse+ zm4NMd9U!kVZ`4D~aDj^CpeV{Yu3u<@z7wX0RAsWFo0X4D2TM<6b<%nQp2WHgD2qAX z>V~b{JhjNTH3fX4D$OlEZpGcC7AYyxq!wvXi?|ClsYNQYeSg|F(~4Z3MC6m106kHtWbbCd-e;-2+3A#A@a1htrA}JE@C>yW zVE>SmZV<1_V)Hx49EVEGLRhd~Yy_Ol1?*Rwaks(PeJX*lm`H&pnsP%lAcmCa#L$el z!ux{e^qfuxZYOJb@&z;rv1)sV2WSkq7T8l%uP;)ECo1#gCeep>7PDY!I!f!5mcFdL zg(r0If+#G}%3S%^vTkiBVyvZNlbLXJ?^Hp%2FR$SuxUa@33Lt=S|Q(Pv|?S2O)~@k zkf@R8$gDaOQ9&JE4U2dut0TX%hmERn12h;>m3h;B#rMrvJczyX04s*CfP&5N|5+VZ zDnudFz;XfX_b9W-pyv1$WfY|e))RGlD#gJ@dOrs!xW%I0K*3^>1`0M%&|Rp3f|c2B zpy2Nu3La~#3#_4+OIXJ}>HdHDUd->1JOkwCv-l>cPuXROHbI1G$z>zL<<3dK zBE*0F<64MV*06+y@b4K&Diz7t;{?-3Vx9@BF_l^TVzm^Q@L&J14ZzP6A@*IUt2Tt# zuZvXbr1c9&h}$2Ft~LX11OEo)@XyC&Oe;gzZ6F?E1gwsv)gi(Vu%QC*N>PaOjy9U_ z#u~dV*AWHKAzJLpF1`3t7N6nH+Dh%LRoNOd#LrQeiIqQ0I)ccwT8hitS!cL*tnE}QxZJtSv}%Tig-~#%z5}SEt}~-CS2uMEyCn;5K1*10 z_Zwe>x=5u17p)Df**2+CHF2+GpgVBQupHMY*F=f;-wAA_J*-|VOB|QrUE*S06@j33 z{O7%dAbBhdOI}1^q&B@2Lsd4St`58GwTDQ5nx{8YLu|N z%sB8=LFQj8U{j%o%R!QEIE#?1hF==YZCbYnzm_qMIrA?&7P?P77V?fgybW@zU<@|M ztwC-La%+%VgWT>4xjBu_YPLYh2G$)QHM#Q?^D|s!FM@at_`|X=#E#Vt;I@$q3)P0( zhINsOc1Ss`4Q|WhHZyguPdQs{9#k^09T09*4&h7{D@h|wL;S8qb21_JWlLUs?<0qH zW^9bd#DC5U=FZr|+yEp_*VxRw47aIVPBcFbiyW&8q;v zN-#)|8xr&pOGRjk8m#)SosF3g%q*#;O8-Abd_ zJLkfhgKu{L!_-YNGyulWkaC}TY-J9*sg<7MMNe$K3xI6k0y(t-vQb^6(vgeS29P=P z!+wpKL@t7mpK)<66L*a=h-~~35ZSmKk?9jz;_=FmsSj;l2g>voo32KHm$VwaM`o^J z+IGV&yT@ks-`b=u&}9bcPB50~-78>KB{B;FR3njvQQr>v{Vw+{CC4SgQR5b2iEvyO zP&ux?{x_(xSfoLX4Qg~3YEWZkwj0#=WuQj00HRsvHe#z8BiH5@sRbQc*hm|(`X^@T#LQ+IiP)M| zk#G}5I}F4nz%l>dO%My7l6Gpq8P-kiUm20~iQU=1C;em9EeECGh|#&m&MaGX1Bd78=J)CQxdLT|=}# zOLqvsf{nN!n6E0OIjICB^%XJLKwcPY6f~FU+zkB|rbvyH7UXz4^gARbqh_1@StPJ5 znbC(jdu5tlvjS|~9s>`|PAC(}J+oPLFVozaDFimzY8`wRk4Lsrb%s)O#PyBUI!~y) zdHOaCYNDvPvpeZ%aYDrt>-IVhieE0*CTA1IyS6O&E=m4D9=U)zZbPIay4FJTNbbV4 z<-qil>eg9<>5D}gOy6L7ccBK;S7y7x^j`+1FR=g%$fLrtm_SodUDz=$>us@ot{w^F zb!{Clig{*Vw*q<}j7~o(dY`xuaR$93l{ZE2le$QyPFfrEzV!u`HNp`GLZ6l+^qHVc znZ=T}Yhk$FvX$>DB(3<$oNp{_(AKx>`Ydf*_i2rNsCq?n<$wu4^Dv~DBX@QJ7>mLe zLBarp$C^|tbLK&sytGON7<+%RV*`lhp*apGxW@sM9faZG4OhcZXcDshp;oesA)}NwoIbMI~G@4TFSOv zRTpCmRz_8-TA*nQ4!kz4zVbGBtyrYNYYkp=7i#cYWwsl<_GRF;5?g5-oFkC)o8{n1;cntM#bEg3`bu7bNHJud@)OER73?+tn2X^Xpt1p8Mcq$fY zz*7UB+=UwORGIAtJbfA9Nt`Lk+kFMc>D{gP|MT-nd*Qta{3nM|yk;Stzuy{JRa=AA z0l30S+@LJHJiA*Lt-^#Ur?v!V-Hh6rXf?6w;%(dvIC-Z@`L8$yfi85r}MnGjcFa(Ar2DEdn29QrfJEaJVSGYg|xXCcCZ zIgHEP-P}>Rj^YF+`I-Ur zV?}EB*edub?Ua7E->2Ok{(L(0Q+= z-oB?tmfmZT5Qg=B0>i()pX+)o@yhRsYVSROzml%s1CF6fFyI&HEA$`~@VU7n969*I zZ@TL5_~nyw*?olP>!NRhkmF>Nh29*iQEev|XODO z8@*FRKA#IX2=xn+TUMdLc+?_;*e77x;3aUcm-G;TI-qR@)PDec5Xi$|1bZ-yn4h%C z$$5|v-J^if#qgzlVd5pBmX`{U!bgQG4?v196Z}n{xQbOPS?MD^FXAVr3qQ2&DO;v&S11DOa(!)-hC@$FW3c${ z8~yTgUBX$%+h8eP*K_;2Wv7fprGTAn$cbOB(kv2=qj2NuCQEIX4~F9<*J}7CQH{w} zu=s9%JrlLD&H6lwos4J-&FDLbf+ar)3lxc`TM(0MR(Ke+IyK~Z6vG?rias`!smlM5 zG07b-!Fm-}VH*J0TP&xIC)GyQ?61nbZz%_77fA3YMr`lk#}^K|V0yyhA22BOOId*u zV@CgFr=S+fBYw6CvE9q(<{*A~+oBFF|1Xr1Ea?LLE9(aQt4N%fHZKBpwuI#*@RCnX zP-;@i6XTzrAh9-nADw+ZeRF_`7HXiT?D4N9GcErpZ{*uwt@mwiVL|iW!kYZu6)cvlgaFIb>6xW&6$7!mp{C2v~1%;dQZmeh1gS+J&h z5lRkdcUTG~_rgfx`_h3BO;TMX(+y69XZH?@)-cm`S6N6~NN7%it~aFiRvQt7$>SH< zS5uopBS{;7IqVD@z5a2%5O&7n)zilbV7=wpQ*@m^eB4pr$YID?g0OLpd14{~iRMul zMgm~Y_&gHVR3vK_icMDmnN)bTk^iNd zzs@@5T)S=bI3%6&KI{N`KdOF6m|oe% z!O{yi(&ysAG*HQ-qPfV-grO9Gwo?Mi905=U`4LPcGFffb<6+!7mNx=Pc6V^fuyt4+ zhCc-442(%fL8=&FQ`kAhSvMpg_biI`5xD?ymAebL#mk!+YvqEy_qRx*BDOEvXc zME@+jK44ChqYbQPXI+vuLv>MI|g|{r|ZY zNTy1oMf}JstKKNNR9jtTvs|?{xh)S(M804J!=v)6o?H(f2Md_0v1fHl%-*%7-bVpa z6}guHrTtS^zH~ly05U{sDad$MPxs#8HV!m68Li$!vmEUb^Yv*(^U-abx_n1hyi)Fq zxyA>xmG5PHpGyWll>1n&^Q~0(sbm^+_)xa-oowYZxz1OzwT~pj%~d{;t9>C?_&|yq zIa*e&)PmLDeq%p2@Ak^}NgPn3yk7gM1{rxL+x5FwnrW@f zx8e5<7=6L~@=a>lq&Ce7XA4@GQKg<#7uzdEQW=7he|O9tV6WvH8Dwz6lD9`0+k+k) zKf4V({ZGTrpI#juoCMxmzOI*@!EM-aJLzxZeNZ*r0H4dhN?xIP5GU(H2`4e037e6- zwPV_wWLGtf)$_{8(wgbxUo(rS+_^5(e_&{0l8d5(+jBcww7p zJ8_caZ*=_EcS))5Nvzn$Z)D%g);ab8od-i#~(LAO0UuO928D02BZK00;oa zVTxSgaXmL_2><}1Apigu000000000000000000000Aq4xVRU6xX+&jaX>MtBX>V>W zYIARHP)h*<6aW+e000O8?_r8uV26s7!j=I5=g$uS5dZ)H000000RSKX005o|003=a oX>L?yZE$R1bY(7Tb8l`?O9ci10000200IDn0001wpaB2?032oE5&!@I literal 0 HcmV?d00001 diff --git a/Solutions/AzureSecurityBenchmark/Package/mainTemplate.json b/Solutions/AzureSecurityBenchmark/Package/mainTemplate.json index dc0b0d4caf7..fcc6e60f2e4 100644 --- a/Solutions/AzureSecurityBenchmark/Package/mainTemplate.json +++ b/Solutions/AzureSecurityBenchmark/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "AzureSecurityBenchmark", - "_solutionVersion": "3.0.3", + "_solutionVersion": "3.0.4", "solutionId": "azuresentinel.azure-sentinel-solution-azuresecuritybenchmark", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -94,7 +94,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureSecurityBenchmarkPostureChanged_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "AzureSecurityBenchmarkPostureChanged_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -120,7 +120,6 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": [], "tactics": [ "Discovery" ], @@ -131,8 +130,8 @@ { "fieldMappings": [ { - "columnName": "RemediationLink", - "identifier": "Url" + "identifier": "Url", + "columnName": "RemediationLink" } ], "entityType": "URL" @@ -191,7 +190,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Notify_GovernanceComplianceTeam-SecurityBenchmark Playbook with template version 3.0.3", + "description": "Notify_GovernanceComplianceTeam-SecurityBenchmark Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -455,7 +454,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Create-AzureDevOpsTask-ASB Playbook with template version 3.0.3", + "description": "Create-AzureDevOpsTask-ASB Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -682,7 +681,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CreateJiraIssue-ASB Playbook with template version 3.0.3", + "description": "CreateJiraIssue-ASB Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -897,7 +896,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AzureSecurityBenchmark Workbook with template version 3.0.3", + "description": "AzureSecurityBenchmark Workbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -915,7 +914,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a4b4e975-fa7c-46a3-b669-850aacc88134\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"🔎 Getting Started\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\"}\\r\\n]\",\"value\":\"No\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"id\":\"314d02bf-4691-43fa-af59-d67073c8b8fa\"},{\"id\":\"e6ded9a1-a83c-4762-938d-5bf8ff3d3d38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"e3225ed0-6210-40a1-b2d0-66e42ffa71d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| order by name asc\\r\\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\\r\\n| mvexpand All limit 100\\r\\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"15b2c181-7397-43c1-900a-28e175ae8a6f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Parameter Selectors\"},{\"type\":1,\"content\":{\"json\":\"  Please take time to answer a quick survey,\\r\\n[ click here. ](https://forms.office.com/r/sxvBsuTcmM)\"},\"name\":\"Survey\"},{\"type\":1,\"content\":{\"json\":\"## Getting Started\\r\\nThis solution leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align directly with the Azure Security Benchmark. A filter set in guide, subscription, workspace, time, and ASB control are available for customized reporting and review. The documentation below provides getting started recommendations for centralizing log analytics data and enabling Microsoft Defender for Cloud Continuous Export. This offering includes integration with Microsoft 1st Party, Partner 3rd Party ecosystem, hybrid, on-premises, and multi-cloud workloads. Common use cases include conducting ASB assessments which custom reporting, time filtering, subscription filtering, workspace filtering, and guides. The report is exportable for print or PDF with the Print Workbook feature. The solution is organized by ASB control areas, each area has multiple control cards. Control cards include ASB logging over time, current ASB assessment recommendations, ASB status, documentation guides, recommendations, and links to product pages, documentation, and portals for all referenced products.
\\r\\n\\r\\n### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions)\\r\\n| Roles | Rights | \\r\\n|:--|:--|\\r\\n|Security Reader | View solutions, Analytics, Security Recommendations |\\r\\n|Security Contributor| Deploy/Modify solutions, Analytics, Apply Security Recommendations |\\r\\n|Owner| Assign Regulatory Compliance Initiatives|\\r\\n\\r\\n### Onboarding Prerequisites \\r\\n1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
\\r\\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\\r\\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\\r\\n4️⃣ [Add the Azure Security Benchmark Assessment to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\\r\\n5️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n6️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\\r\\n7️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
\\r\\n8️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
\\r\\n\\r\\n### Print/Export Report\\r\\n1️⃣ Set Background Theme: Settings > Appearance > Theme: Azure > Apply
\\r\\n2️⃣ Print/Export Report: More Content Actions (...) > Print Content
\\r\\n3️⃣ Settings: Layout (Landscape), Pages (All), Print (One Sided), Scale (60), Pages Per Sheet (1), Quality (1,200 DPI), Margins (None) > Print
\\r\\n4️⃣ Executive Summary: Microsoft Defender for Cloud > Regulatory Compliance > Download Report > Report Standard (Azure Security Benchmark), Format (PDF)\\r\\n\\r\\n### Important\\r\\nThis solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All requirements, validations, and controls are governed by respective organizations. This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. \",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Help\"},{\"type\":1,\"content\":{\"json\":\"# [Azure Security Benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\\n---\\n\\nThe Azure Security Benchmark v3 Solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Azure Security Benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. \"},\"customWidth\":\"79\",\"name\":\"Workbook Overview\"},{\"type\":1,\"content\":{\"json\":\"![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) \"},\"customWidth\":\"20\",\"name\":\"Microsoft Sentinel Logo\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Posture Assessment\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AT\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Controls Crosswalk\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"CMA\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Network Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Identity Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Privileged Access\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Data Protection\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Asset Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Section\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"Control Areas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a30d01d0-38f1-4a91-9cf6-cdb181d676b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isATVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AT\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"c01e9b8b-b285-4aae-8510-68741e0315c3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isCMAVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"CMA\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"d41cb044-86ef-4603-ae24-c61e864c067d\"},{\"id\":\"7b682fc9-cb6b-4475-a24c-41dcb43d0cef\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIMVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPAVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"15158143-a4f8-417b-90b0-123dd13f1ff5\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDPVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"0077d493-a27d-49d7-b49d-5888805d501e\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAMVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"33690532-5a73-4ac3-8fbd-6fc449a6d166\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Logging & Threat Detection\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Incident Response\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Posture & Vulnerability Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Endpoint Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Backup & Recovery\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"DevOps Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Governance & Strategy\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Section\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"Control Areas - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLTVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"b7db9449-1027-45a8-a5c1-2eb371722ba6\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIRVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"26b9ae7c-7cfe-4606-8318-d7ff172a1e1a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPVVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"0ece4c93-cbf9-4b8c-a0ad-ddfa6635919a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isESVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"ebead9f9-b4cc-4ab4-9c06-a5d9ac643825\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBRVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"dcd1bbe4-4979-4459-8b8b-3d2a3f6f7783\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"342935cc-8a23-46f8-96a6-974808db01c5\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"a00fd6f7-5f8d-487d-948f-804ab0288aae\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Posture Assessment](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\\r\\n---\\r\\nThe Posture Assessment section provides a mechanism to find, fix, and resolve Azure Security Benchmark recommendations. A selector provides capability to filter by all, specific, or groups of control families. Upon selection, subordinate panels will summarize recommendations by control family, status over time, recommendations, and resources identified with deep-link for remediation.\"},\"customWidth\":\"40\",\"name\":\"NS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"10\",\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"99a47f97-1aa4-4840-91ee-119aad6d6217\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ComplianceDomain\",\"label\":\"Control Area\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| where ComplianceStandard == \\\"Azure-Security-Benchmark\\\"\\r\\n| extend ComplianceDomain=iff(ComplianceControl contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ComplianceControl contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ComplianceControl contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ComplianceControl contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ComplianceControl contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ComplianceControl contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ComplianceControl contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ComplianceControl contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ComplianceControl contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ComplianceControl contains \\\"NS.\\\", \\\"Network Security\\\", iff(ComplianceControl contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ComplianceControl contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| summarize count() by ComplianceDomain\\r\\n| sort by count_ desc\\r\\n| project-away count_\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"40\",\"name\":\"parameters - 26\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink) on RecommendationName\\r\\n| extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain}) \\r\\n | distinct RecommendationName, ComplianceDomain, tostring(RecommendationLink), tostring(state), tostring(complianceState)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\" or complianceState == \\\"Failed\\\") by ComplianceDomain\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n | project ControlFamily=ComplianceDomain, Total, PassedControls, Passed, Failed\\r\\n | sort by Total, Passed desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations by Control Area\",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_compositeBar_Total_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_compositeBar_Total_1\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName\\r\\n| extend ComplianceDomain=iff(ControlID contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ControlID contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ControlID contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ControlID contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ControlID contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ControlID contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ControlID contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ControlID contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ControlID contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ControlID contains \\\"NS.\\\", \\\"Network Security\\\", iff(ControlID contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ControlID contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain}) \\r\\n| extend Remediate=RecommendationLink\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain}) \\r\\n| distinct RecommendationName, resourceId, tostring(state), tostring(complianceState)\\r\\n| summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\") by resourceId\\r\\n| extend PassedControls = (Passed/todouble(Total))*100\\r\\n| where Failed > 0\\r\\n| project AssessedResourceId=resourceId, Total, PassedControls, Passed, Failed\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations by Asset\",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AssessedResourceId\",\"formatter\":13,\"formatOptions\":{\"linkTarget\":\"Resource\",\"showIcon\":true}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| where ComplianceStandard == \\\"Azure-Security-Benchmark\\\"\\r\\n| extend ComplianceDomain=iff(ComplianceControl contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ComplianceControl contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ComplianceControl contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ComplianceControl contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ComplianceControl contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ComplianceControl contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ComplianceControl contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ComplianceControl contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ComplianceControl contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ComplianceControl contains \\\"NS.\\\", \\\"Network Security\\\", iff(ComplianceControl contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ComplianceControl contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain})\\r\\n| where State == \\\"Failed\\\"\\r\\n| make-series count() default=0 on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step 1d by ComplianceDomain\\r\\n| render timechart \",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations over Time\",\"noDataMessage\":\"No failed controls observed within these thresholds. Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and onboarded to Microsoft Sentinel Workspace.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain}) \\r\\n| where state == \\\"Unhealthy\\\"\\r\\n| extend FirstObserved = properties1.status.statusChangeDate\\r\\n| parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| project ResourceID=resourceId, RecommendationName, ControlFamily=ComplianceDomain, ControlID=controlId, Severity=severity, CurrentState=state, Remediate=RecommendationLink, FirstObserved, assessmentKey\\r\\n| extend Rank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, 0)))\\r\\n| sort by Rank desc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Current Recommendation Details\",\"noDataMessage\":\"No failed controls observed within these thresholds. Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and onboarded to Microsoft Sentinel Workspace.\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ResourceID\",\"formatter\":13,\"formatOptions\":{\"linkTarget\":\"Resource\",\"showIcon\":true}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlFamily\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"linkIsContextBlade\":false,\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"FirstObserved\",\"formatter\":6},{\"columnMatch\":\"assessmentKey\",\"formatter\":5},{\"columnMatch\":\"Rank\",\"formatter\":5}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Severity_4\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Severity_4\",\"sortOrder\":1}]},\"name\":\"query - 8\"}]},\"conditionalVisibility\":{\"parameterName\":\"isATVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Assessment\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Controls Crosswalk](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\\r\\n---\\r\\nControls crosswalk provides a mapping of Azure Security Benchmark v3 controls across additional compliance frameworks. This provides free-text search capabilities mapping numerous frameworks including CIS v8, NIST SP 800-53 R4, and PCI-DSS v3. There is also a mapping for recommended Microsoft products for each of these control requirements. \"},\"customWidth\":\"40\",\"name\":\"Controls Mapping\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Crosswalk = datatable([\\\"Control Name\\\"]: string, [\\\"ASB v3\\\"]: string, [\\\"Control Area\\\"]: string, [\\\"CIS v8\\\"]: string, [\\\"NIST SP 800-53 R4\\\"]: string, [\\\"PCI-DSS v3\\\"]: string, [\\\"Recommended Products\\\"]: string) [\\r\\n\\\"NS-1: Establish network segmentation boundaries\\\",\\t\\\"NS-1\\\",\\t\\\"Network Security\\\",\\t\\\"3.12 | 13.4 | 4.4\\\",\\t\\\"\\tAC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"VirtualNetwork\\\",\\r\\n\\\"NS-2: Secure cloud services with network controls\\\",\\t\\\"NS-2\\\",\\t\\\"Network Security\\\",\\t\\\"3.12 | 4.4\\\",\\t\\\"AC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Virtual Network | Private Link\\\",\\r\\n\\\"NS-3: Deploy firewall at the edge of enterprise network\\\",\\t\\\"NS-3\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8 | 13.10\\\",\\t\\\"AC-4 | SC-7 | CM-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Firewall\\\",\\r\\n\\\"NS-4: Deploy intrusion detection/intrusion prevention systems (IDS/IPS)\\\",\\t\\\"NS-4\\\",\\t\\\"Network Security\\\",\\t\\\"13.2 | 13.3 | 13.7 | 13.8\\\",\\t\\\"SC-7 | SI-4\\\",\\t\\\"11.4\\\",\\t\\\"Azure Firewall | Microsoft Defender for Endpoint\\\",\\r\\n\\\"NS-5: Deploy DDOS protection\\\",\\t\\\"NS-5\\\",\\t\\\"Network Security\\\",\\t\\\"13.1\\\",\\t\\\"SC-5 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3 | 6.6\\\",\\t\\\"Azure DDoS Protection\\\",\\r\\n\\\"NS-6: Deploy web application firewall\\\",\\t\\\"NS-6\\\",\\t\\\"Network Security\\\",\\t\\\"13.1\\\",\\t\\\"SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Web Application Firewall\\\",\\r\\n\\\"NS-7: Simplify network security configuration\\\",\\t\\\"NS-7\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8\\\",\\t\\\"AC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Firewall Manager\\\",\\r\\n\\\"NS-8: Detect and disable insecure services and protocols\\\",\\t\\\"NS-8\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8\\\",\\t\\\"CM-2 | CM-6 | CM-7\\\",\\t\\\"4.1 | A2.1 | A2.2 | A2.3\\\",\\t\\\"Microsoft Sentinel | Azure Active Directory | Microsoft Defender for Endpoint\\\",\\r\\n\\\"NS-9: Connect on-premises or cloud network privately\\\",\\t\\\"NS-9\\\",\\t\\\"Network Security\\\",\\t\\\"12.7\\\",\\t\\\"CA-3 | AC-17 | AC-4\\\",\\t\\\"N/A\\\",\\t\\\"VPN Gateway | Azure ExpressRoute | Virtual Network\\\",\\r\\n\\\"NS-10: Ensure Domain Name System (DNS) security\\\",\\t\\\"NS-10\\\",\\t\\\"Network Security\\\",\\t\\\"4.9 | 9.2\\\",\\t\\\"SC-20 | SC-21\\\",\\t\\\"N/A\\\",\\t\\\"Azure DNS\\\",\\r\\n\\\"IM-1: Use centralized identity and authentication system\\\",\\t\\\"IM-1\\\",\\t\\\"Identity Management\\\",\\t\\\"6.7 | 12.5\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-8\\\",\\t\\\"7.2 | 8.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-2: Protect identity and authentication systems\\\",\\t\\\"IM-2\\\",\\t\\\"Identity Management\\\",\\t\\\"5.4 | 6.5\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-8 | SI-4\\\",\\t\\\"8.2, 8.3\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-3: Manage application identities securely and automatically\\\",\\t\\\"IM-3\\\",\\t\\\"Identity Management\\\",\\t\\\"N/A\\\",\\t\\\"N/A\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-4: Authenticate server and services\\\",\\t\\\"IM-4\\\",\\t\\\"Identity Management\\\",\\t\\\"N/A\\\",\\t\\\"IA-9\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"IM-5: Use single sign-on (SSO) for application access\\\",\\t\\\"IM-5\\\",\\t\\\"Identity Management\\\",\\t\\\"12.5\\\",\\t\\\"IA-4 | IA-2 | IA-8\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-6: Use strong authentication controls\\\",\\t\\\"IM-6\\\",\\t\\\"Identity Management\\\",\\t\\\"6.3 | 6.4\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-5 | IA-8\\\",\\t\\\"7.2 | 8.2 | 8.3 | 8.4\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-7: Restrict resource access based on conditions\\\",\\t\\\"IM-7\\\",\\t\\\"Identity Management\\\",\\t\\\"3.3 | 6.4 | 13.5\\\",\\t\\\"AC-2 | AC-3 | AC-6\\\",\\t\\\"7.2\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-8: Restrict the exposure of credential and secrets\\\",\\t\\\"IM-8\\\",\\t\\\"Identity Management\\\",\\t\\\"16.9 | 16.12\\\",\\t\\\"IA-5\\\",\\t\\\"3.5 | 6.3 | 8.2\\\",\\t\\\"Microsoft Sentinel | Azure Active Directory | Microsoft Defender for Endpoint\\\",\\r\\n\\\"IM-9: Secure user access to existing applications\\\",\\t\\\"IM-9\\\",\\t\\\"Identity Management\\\",\\t\\\"6.7 | 12.5\\\",\\t\\\"AC-2 | AC-3 | SC-11\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud Apps\\\",\\r\\n\\\"PA-1: Separate and limit highly privileged/administrative users\\\",\\t\\\"PA-1\\\",\\t\\\"Privileged Access\\\",\\t\\\"5.4 | 6.8\\\",\\t\\\"AC-2 | AC-6\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-2: Avoid standing access for user accounts and permissions\\\",\\t\\\"PA-2\\\",\\t\\\"Privileged Access\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"AC-2\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PA-3: Manage lifecycle of identities and entitlements\\\",\\t\\\"PA-3\\\",\\t\\\"Privileged Access\\\",\\t\\\"N/A\\\",\\t\\\"AC-5 | AC-6\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-4: Review and reconcile user access regularly\\\",\\t\\\"PA-4\\\",\\t\\\"Privileged Access\\\",\\t\\\"5.1 | 5.3 | 5.5\\\",\\t\\\"5.1 | 5.3 | 5.5\\\",\\t\\\"7.1 | 7.2 | 8.1 | A3.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-5: Set up emergency access\\\",\\t\\\"PA-5\\\",\\t\\\"Privileged Access\\\",\\t\\\"N/A\\\",\\t\\\"AC-2\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-6: Use privileged access workstations\\\",\\t\\\"PA-6\\\",\\t\\\"Privileged Access\\\",\\t\\\"12.8 | 13.5\\\",\\t\\\"AC-2 | SC-2 | SC-7\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-7: Follow just enough administration (least privilege) principles\\\",\\t\\\"PA-7\\\",\\t\\\"Privileged Access\\\",\\t\\\"3.3 | 6.8\\\",\\t\\\"AC-2 | AC-3 | AC-6\\\",\\t\\\"7.1 | 7.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-8: Determine access process for cloud provider support\\\",\\t\\\"PA-8\\\",\\t\\\"Privileged Access\\\",\\t\\\"6.1 | 6.2\\\",\\t\\\"AC-4 | AC-2 | AC-3\\\",\\t\\\"N/A\\\",\\t\\\"Customer Lockbox\\\",\\r\\n\\\"DP-1: Discover | classify | and label sensitive data\\\",\\t\\\"DP-1\\\",\\t\\\"Data Protection\\\",\\t\\\"3.2 | 3.7 | 3.13\\\",\\t\\\"RA-2 | SC-28\\\",\\t\\\"A3.2\\\",\\t\\\"Azure Information Protection\\\",\\r\\n\\\"DP-2: Monitor anomalies and threats targeting sensitive data\\\",\\t\\\"DP-2\\\",\\t\\\"Data Protection\\\",\\t\\\"3.13\\\",\\t\\\"AC-4 | SI-4\\\",\\t\\\"A3.2\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Sentinel\\\",\\r\\n\\\"DP-3: Encrypt sensitive data in transit\\\",\\t\\\"DP-3\\\",\\t\\\"Data Protection\\\",\\t\\\"3.1\\\",\\t\\\"SC-8\\\",\\t\\\"3.5 | 3.6 | 4.1\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DP-4: Enable data at rest encryption by default\\\",\\t\\\"DP-4\\\",\\t\\\"Data Protection\\\",\\t\\\"3.11\\\",\\t\\\"SC-28\\\",\\t\\\"3.4 | 3.5\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DP-5: Use customer-managed key option in data at rest encryption when required\\\",\\t\\\"DP-5\\\",\\t\\\"Data Protection\\\",\\t\\\"3.11\\\",\\t\\\"SC-12 | SC-28\\\",\\t\\\"3.4 | 3.5 | 3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"DP-6: Use a secure key management process\\\",\\t\\\"DP-6\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-28\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"DP-7: Use a secure certificate management process\\\",\\t\\\"DP-7\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-17\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Sentinel\\\",\\r\\n\\\"DP-8: Ensure security of key and certificate repository\\\",\\t\\\"DP-8\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-17\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"AM-1: Track asset inventory and their risks\\\",\\t\\\"AM-1\\\",\\t\\\"Asset Management\\\",\\t\\\"1.1 | 1.5 | 2.1 | 2.4\\\",\\t\\\"CM-8 | PM-5\\\",\\t\\\"2.4\\\",\\t\\\"Azure Resource Graph\\\",\\r\\n\\\"AM-2: Use only approved services\\\",\\t\\\"AM-2\\\",\\t\\\"Asset Management\\\",\\t\\\"2.5 | 2.6 | 2.7 | 4.8\\\",\\t\\\"CM-8 | PM-5\\\",\\t\\\"6.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Resource Graph\\\",\\r\\n\\\"AM-3: Ensure security of asset lifecycle management\\\",\\t\\\"AM-3\\\",\\t\\\"Asset Management\\\",\\t\\\"1.1 | 2.1\\\",\\t\\\"CM-8 | CM-7\\\",\\t\\\"2.4\\\",\\t\\\"Azure Monitor\\\",\\r\\n\\\"AM-4: Limit access to asset management\\\",\\t\\\"AM-4\\\",\\t\\\"Asset Management\\\",\\t\\\"3.3\\\",\\t\\\"AC-3\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"AM-5: Use only approved applications in virtual machine\\\",\\t\\\"AM-5\\\",\\t\\\"Asset Management\\\",\\t\\\"2.5 | 2.6 | 2.7 | 4.8\\\",\\t\\\"CM-8 | CM-7 | CM-10 | CM-11\\\",\\t\\\"6.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"LT-1: Enable threat detection capabilities\\\",\\t\\\"LT-1\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.6 | 10.8 | A3.5\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Microsoft Defender for Cloud Apps | Azure Active Directory | Microsoft Defender for Endpoint | Microsoft Defender for Office 365\\\",\\r\\n\\\"LT-2: Enable threat detection for identity and access management\\\",\\t\\\"LT-2\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.6 | 10.8 | A3.5\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"LT-3: Enable logging for security investigation\\\",\\t\\\"LT-3\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.2 | 8.5 | 8.12\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.1 | 10.2 | 10.3\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-4: Enable network logging for security investigation\\\",\\t\\\"LT-4\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.2 | 8.5 | 8.6 | 8.7 | 13.6\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Defender for Cloud | Azure Firewall | Azure Web Application Firewall | Application Gateway | Virtual Network | Azure Resource Graph\\\",\\r\\n\\\"LT-5: Centralize security log management and analysis\\\",\\t\\\"LT-5\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.9 | 8.11 | 13.1\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-6: Configure log storage retention\\\",\\t\\\"LT-6\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.3 | 8.10\\\",\\t\\\"AU-11\\\",\\t\\\"10.5 | 10.7\\\",\\t\\\"Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-7: Use approved time synchronization sources\\\",\\t\\\"LT-7\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.4\\\",\\t\\\"AU-8\\\",\\t\\\"10.4\\\",\\t\\\"Azure Active Directory Domain Services | Azure Policy | Virtual Machines\\\",\\r\\n\\\"IR-1: Preparation - update incident response plan and handling process\\\",\\t\\\"IR-1\\\",\\t\\\"Incident Response\\\",\\t\\\"17.4 | 17.7\\\",\\t\\\"IR-4 | IR-8\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"IR-2: Preparation - setup incident notification\\\",\\t\\\"IR-2\\\",\\t\\\"Incident Response\\\",\\t\\\"17.1 | 17.3 | 17.6\\\",\\t\\\"IR-4 | IR-8 | IR-5 | IR-6\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Logic Apps\\\",\\r\\n\\\"IR-3: Detection and analysis - create incidents based on high-quality alerts\\\",\\t\\\"IR-3\\\",\\t\\\"Incident Response\\\",\\t\\\"17.9\\\",\\t\\\"IR-4 | IR-5 | IR-7\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud\\\",\\r\\n\\\"IR-4: Detection and analysis - investigate an incident\\\",\\t\\\"IR-4\\\",\\t\\\"Incident Response\\\",\\t\\\"N/A\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"IR-5: Detection and analysis - prioritize incidents\\\",\\t\\\"IR-5\\\",\\t\\\"Incident Response\\\",\\t\\\"17.4 | 17.9\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud\\\",\\r\\n\\\"IR-6: Containment | eradication and recovery - automate the incident handling\\\",\\t\\\"IR-6\\\",\\t\\\"Incident Response\\\",\\t\\\"N/A\\\",\\t\\\"IR-4 | IR-5 | IR-6\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Azure Logic Apps\\\",\\r\\n\\\"IR-7: Post-incident activity - conduct lesson learned and retain evidence\\\",\\t\\\"IR-7\\\",\\t\\\"Incident Response\\\",\\t\\\"17.8\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Azure Logic Apps\\\",\\r\\n\\\"PV-1: Define and establish secure configurations\\\",\\t\\\"PV-1\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"1.1\\\",\\t\\\"Azure Policy | Azure Blueprints\\\",\\r\\n\\\"PV-2: Audit and enforce secure configurations\\\",\\t\\\"PV-2\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PV-3: Define and establish secure configurations for compute resources\\\",\\t\\\"PV-3\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"PV-4: Audit and enforce secure configurations for compute resources\\\",\\t\\\"PV-4\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PV-5: Perform vulnerability assessments\\\",\\t\\\"PV-5\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"5.5 | 7.1 | 7.5 | 7.6\\\",\\t\\\"RA-3 | RA-5\\\",\\t\\\"6.1 | 6.2 | 6.6\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"PV-6: Rapidly and automatically remediate vulnerabilities\\\",\\t\\\"PV-6\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"7.2 | 7.3 | 7.4 | 7.7\\\",\\t\\\"RA-3 | RA-5 | SI-2\\\",\\t\\\"6.1 | 6.2 | 6.5 | 11.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"PV-7: Conduct regular red team operations\\\",\\t\\\"PV-7\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"18.1 | 18.2 | 18.3 | 18.4 | 18.5\\\",\\t\\\"CA-8 | RA-5\\\",\\t\\\"6.6 | 11.2 | 11.3\\\",\\t\\\"Microsoft Sentinel | Microsoft 365 Compliance Manager\\\",\\r\\n\\\"ES-1: Use Endpoint Detection and Response (EDR)\\\",\\t\\\"ES-1\\\",\\t\\\"Endpoint Security\\\",\\t\\\"13.7\\\",\\t\\\"SC-3 | SI-2 | SI-3 | SI-16\\\",\\t\\\"11.5\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"ES-2: Use modern anti-malware software\\\",\\t\\\"ES-2\\\",\\t\\\"Endpoint Security\\\",\\t\\\"10.1\\\",\\t\\\"SC-3 | SI-2 | SI-3 | SI-16\\\",\\t\\\"5.1\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"ES-3: Ensure anti-malware software and signatures are updated\\\",\\t\\\"ES-3\\\",\\t\\\"Endpoint Security\\\",\\t\\\"10.2\\\",\\t\\\"SI-2 | SI-3\\\",\\t\\\"5.2\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"BR-1: Ensure regular automated backups\\\",\\t\\\"BR-1\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.2\\\",\\t\\\"CP-2 | CP-4 | CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud | Azure Backup\\\",\\r\\n\\\"BR-2: Protect backup and recovery data\\\",\\t\\\"BR-2\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.3\\\",\\t\\\"CP-6 | CP-9\\\",\\t\\\"3.4\\\",\\t\\\"Microsoft Defender for Cloud | Azure Backup\\\",\\r\\n\\\"BR-3: Monitor backups\\\",\\t\\\"BR-3\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.3\\\",\\t\\\"CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Azure Backup | Key Vault\\\",\\r\\n\\\"BR-4: Regularly test backups\\\",\\t\\\"BR-4\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.5\\\",\\t\\\"CP-4 | CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Azure Backup | Key Vault\\\",\\r\\n\\\"DS-1: Conduct Threat Modeling\\\",\\t\\\"DS-1\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.10 | 16.14\\\",\\t\\\"SA-15\\\",\\t\\\"6.5 | 12.2\\\",\\t\\\"Threat Modeling Tool | Microsoft Sentinel\\\",\\r\\n\\\"DS-2: Ensure Software Supply Chain Security\\\",\\t\\\"DS-2\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.4 | 16.6 | 16.11\\\",\\t\\\"SA-12 | SA-15\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Microsoft Defender for Cloud | GitHub\\\",\\r\\n\\\"DS-3: Secure DevOps Infrastructure\\\",\\t\\\"DS-3\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.7\\\",\\t\\\"CM-2 | CM-6 | AC-2 | AC-3 | AC-6\\\",\\t\\\"2.2 | 6.3 | 7.1\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"DS-4: Integrate Static Application Security Testing into DevOps Pipeline\\\",\\t\\\"DS-4\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.12\\\",\\t\\\"SA-11\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Credential Scanner | Binskim | CodeQL | GitHub: Secret Scanning\\\",\\r\\n\\\"DS-5: Integrate Dynamic Application Security Testing into DevOps Pipeline\\\",\\t\\\"DS-5\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.12\\\",\\t\\\"SA-11\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Azure DevOps | Azure Marketplace\\\",\\r\\n\\\"DS-6: Enforce Security of Workload throughout DevOps Lifecycle\\\",\\t\\\"DS-6\\\",\\t\\\"DevOps Security\\\",\\t\\\"7.5 | 7.6 | 7.7 | 16.1 | 16.7\\\",\\t\\\"CM-2 | CM-6 | AC-2 | AC-3 | AC-6\\\",\\t\\\"6.1 | 6.2 | 6.3\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DS-7: Enable Logging and Monitoring in DevOps\\\",\\t\\\"DS-7\\\",\\t\\\"DevOps Security\\\",\\t\\\"8.2 | 8.5 | 8.9 | 8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.1 | 10.2 | 10.3 | 10.6\\\",\\t\\\"Microsoft Sentinel | GitHub | Azure DevOps\\\",\\r\\n\\\"GS-1: Align organization roles | responsibilities and accountabilities\\\",\\t\\\"GS-1\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"14.9\\\",\\t\\\"PL-9 | PM-10 | PM-13 | AT-1 | AT-3\\\",\\t\\\"2.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"GS-2: Define and implement enterprise segmentation/separation of duties strategy\\\",\\t\\\"GS-2\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"3.12\\\",\\t\\\"AC-4 | SC-7 | SC-2\\\",\\t\\\"1.2 | 6.4\\\",\\t\\\"Azure ExpressRoute | VPN Gateway | Azure Active Directory\\\",\\r\\n\\\"GS-3: Define and implement data protection strategy\\\",\\t\\\"GS-3\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"3.1 | 3.7 | 3.12\\\",\\t\\\"AC-4 | SI-4 | SC-8 | SC-12 | SC-17 | SC-28 | RA-2\\\",\\t\\\"3.1 | 3.2 | 3.3 | 3.4 | 3.5 | 3.6 | 3.7 | 4.1 | A3.2\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Information Protection | Microsoft Defender for Endpoint | Microsoft 365 Defender | Microsoft Defender for Office 365 | Microsoft Cloud App Security\\\",\\r\\n\\\"GS-4: Define and implement network security strategy\\\",\\t\\\"GS-4\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"12.2 | 12.4\\\",\\t\\\"AC-4 | AC-17 | CA-3 | CM-1 | CM-2 | CM-6 | CM-7 | SC-1 | SC-2 | SC-5 | SC-7 | SC-20 | SC-21 | SI-4\\\",\\t\\\"1.1 | 1.2 | 1.3 | 1.5 | 4.1 | 6.6 | 11.4 | A2.1 | A2.2 | A2.3 | A3.2\\\",\\t\\\"Virtual Network | Azure Firewall | Azure Web Application Firewall\\\",\\r\\n\\\"GS-5: Define and implement security posture management strategy\\\",\\t\\\"GS-5\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CA-1 | CA-8 | CM-1 | CM-2 | CM-6 | RA-1 | RA-3 | RA-5 | SI-1 | SI-2 | SI-5\\\",\\t\\\"1.1 | 1.2 | 2.2 | 6.1 | 6.2 | 6.5 | 6.6 | 11.2 | 11.3 | 11.5\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"GS-6: Define and implement identity and privileged access strategy\\\",\\t\\\"GS-6\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"5.6 | 6.5 | 6.7\\\",\\t\\\"AC-1 | AC-2 | AC-3 | AC-4 | AC-5 | AC-6 | IA-1 | IA-2 | IA-4 | IA-5 | IA-8 | IA-9 | SI-4\\\",\\t\\\"7.1 | 7.2 | 7.3 | 8.1 | 8.2 | 8.3 | 8.4 | 8.5 | 8.6 | 8.7 | 8.8 | A3.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"GS-7: Define and implement logging | threat detection and incident response strategy\\\",\\t\\\"GS-7\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"8.1 | 13.1 | 17.2 | 17.4 | 17.7\\\",\\t\\\"AU-1 | IR-1 | IR-2 | IR-10 | SI-1 | SI-5\\\",\\t\\\"10.1 | 10.2 | 10.3 | 10.4 | 10.5 | 10.6 | 10.7 | 10.8 | 10.9 | 12.10 | A3.5\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"GS-8: Define and implement backup and recovery strategy\\\",\\t\\\"GS-8\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"11.1\\\",\\t\\\"CP-1 | CP-9 | CP-10\\\",\\t\\\"3.4\\\",\\t\\\"Azure Backup\\\",\\r\\n\\\"GS-9: Define and implement endpoint security strategy\\\",\\t\\\"GS-9\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.4 | 10.1\\\",\\t\\\"SI-2 | SI-3 | SC-3\\\",\\t\\\"5.1 | 5.2 | 5.3 | 5.4 | 11.5\\\",\\t\\\"Microsoft Defender for Endpoint | Microsoft Defender for Cloud\\\",\\r\\n\\\"GS-10: Define and implement DevOps security strategy\\\",\\t\\\"GS-10\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.1 | 4.2 | 16.1 | 16.2\\\",\\t\\\"SA-12 | SA-15 | CM-1 | CM-2 | CM-6 | AC-2 | AC-3 | AC-6 | SA-11 | AU-6 | AU-12 | SI-4\\\",\\t\\\"2.2 | 6.1 | 6.2 | 6.3 | 6.5 | 7.1 | 10.1 | 10.2 | 10.3 | 10.6 | 12.2\\\",\\t\\\"GitHub | Azure DevOps\\\"\\r\\n];\\r\\nCrosswalk\\r\\n| project [\\\"Control Name\\\"], [\\\"Control Area\\\"], [\\\"Recommended Products\\\"], [\\\"NIST SP 800-53 R4\\\"], [\\\"CIS v8\\\"],[\\\"PCI-DSS v3\\\"]\",\"size\":0,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommended Products\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isCMAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Controls Mapping\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Network Security (NS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)\\r\\n---\\r\\n\\r\\nNetwork Security covers controls to secure and protect Azure networks, including securing virtual networks, establishing private connections, preventing and mitigating external attacks, and securing DNS. \"},\"customWidth\":\"40\",\"name\":\"NS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Establish Network Segmentation Boundaries (NS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure Cloud Services with Network Controls (NS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Firewall at the Edge of Enterprise Network (NS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Intrusion Prevention Systems (NS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy DDOS Protection (NS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5a3550b0-a5cc-40f2-8de4-c6eeb7613825\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"56667767-7bc7-482e-a9ee-a586388dea35\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"97d1ea2a-9b09-41d5-9cc1-1bbe5c450c63\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e3efe6ef-e4f9-4239-a56a-cb759f3232f7\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Web Application Firewall (NS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Simplify Network Security Configuration (NS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Detect and Disable Insecure Services and Protocols (NS-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Connect On-Premises or Cloud Network Privately (NS-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS9\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Domain Name System (DNS) Security (NS-10)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS10\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d73c278-b084-4ad5-a62c-34da79aeb1e4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"632225ba-7633-4757-afac-3acd25aa16a7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"556013a1-3233-4222-805a-4d9e645908cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7910479a-d93a-4529-a520-3a9ee2cd797b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"60660fc5-6d89-41e1-926b-feb8390baf2c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS10Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS10\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Establish Network Segmentation Boundaries (NS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-1-establish-network-segmentation-boundaries)\\r\\n\\r\\nEnsure that your virtual network deployment aligns to your enterprise segmentation strategy defined in the GS-2 security control. Any workload that could incur higher risk for the organization should be in isolated virtual networks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Virtual Network concepts and best practices](https://docs.microsoft.com/azure/virtual-network/concepts-and-best-practices)
\\r\\n💡 [Add, change, or delete a virtual network subnet](https://docs.microsoft.com/azure/virtual-network/virtual-network-manage-subnet)
\\r\\n💡 [How to create a network security group with security rules](https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic)
\\r\\n💡 [Understand and use application security groups](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview#application-security-groups)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n🔀 [Application Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"securitygroups\\\" or type contains \\\"network\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Assets & Infrastructure\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"NetworkSecurityGroupRuleCounter\\\"\\r\\n| summarize\\r\\n Deny = countif(type_s == \\\"block\\\"),\\r\\n Allow = countif(type_s == \\\"allow\\\"),\\r\\n Total = countif(type_s == \\\"allow\\\" or type_s == \\\"block\\\")\\r\\n by ruleName_s, ResourceId\\r\\n| project RuleName=ruleName_s, ResourceId, Total, Allow, Deny\\r\\n| sort by Total desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Security Group Rules by Action Count\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RuleName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"BlankDashboard\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Allow\",\"color\":\"green\"},{\"columnName\":\"Deny\",\"color\":\"redBright\"}]}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isNS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure Cloud Services with Network Controls (NS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls)\\r\\n\\r\\nSecure cloud services by establishing a private access point for the resources. You should also disable or restrict access from public network when possible.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Private Link](https://azure.microsoft.com/services/private-link/) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Azure Private Link](https://docs.microsoft.com/azure/private-link/private-link-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Private Link](https://portal.azure.com/#blade/Microsoft_Azure_Network/PrivateLinkCenterBlade/overview)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"private\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Private Links\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Private Links\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Firewall at Edge of Enterprise Network (NS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-3-deploy-firewall-at-the-edge-of-enterprise-network)\\r\\n\\r\\nDeploy a firewall to perform advanced filtering on network traffic to and from external networks. You can also use firewalls between internal segments to support a segmentation strategy. If required, use custom routes for your subnet to override the system route when you need to force the network traffic to go through a network appliance for security control purpose.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to deploy Azure Firewall](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\\r\\n💡 [Virtual network traffic routing](https://docs.microsoft.com/azure/virtual-network/virtual-networks-udr-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"firewall\\\" and type !contains \\\"web\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Firewalls\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Firewalls\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//reference list posted here : https://docs.microsoft.com/azure/data-explorer/kusto/query/ipv4-lookup-plugin\\r\\nlet geoData = externaldata\\r\\n(network:string,geoname_id:string,continent_code:string,continent_name:string,\\r\\ncountry_iso_code:string,country_name:string,is_anonymous_proxy:string,is_satellite_provider:string)\\r\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"] with (ignoreFirstRecord=true, format=\\\"csv\\\");\\r\\nlet materializedData =\\r\\n(\\r\\nAzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n| project msg_s, Resource, TimeGenerated,ResourceId , ResourceGroup , SubscriptionId);\\r\\nunion\\r\\n(\\r\\n// Azure Firewall Networking - Standard Log\\r\\nmaterializedData\\r\\n| where msg_s !has \\\"Type=\\\" and msg_s !has \\\"DNAT'ed\\\" and msg_s !has \\\"Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking with ICMP\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Type=\\\"\\r\\n| parse msg_s with Protocol \\\" Type=\\\" ICMPType \\\" request from \\\" SourceIP \\\" to \\\" DestinationIP \\\". Action: \\\" Action\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule - Standard\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s !has \\\". Rule Collection:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule (firewall not using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s has \\\". Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination \\\". Rule Collection: \\\" RuleCollection \\\". Rule: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule (firewall using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s has \\\". Rule Collection:\\\" and msg_s has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination \\\". Policy: \\\" Policy \\\". Rule Collection Group:\\\" RuleCollectionGroup \\\". Rule Collection: \\\" RuleCollection \\\". Rule: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Network rule (firewall not using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection: \\\" RuleCollection \\\". Rule Name: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Network rule (firewall using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Policy:\\\" Policy \\\". Rule Collection Group:\\\" RuleCollectionGroup \\\". Rule Collection: \\\" RuleCollection \\\". Rule Name: \\\" Rule\\r\\n)\\r\\n| summarize by TimeGenerated,Protocol, ICMPType, Action,SourceIP, SourcePort, DestinationIP , DestinationPort , NatDestination, ResourceId , ResourceGroup , SubscriptionId\\r\\n| evaluate ipv4_lookup (geoData, DestinationIP, network, false)\\r\\n| project ResourceId, Action, Protocol, SourceIP, SourcePort, DestinationIP, DestinationPort, country_name,TimeGenerated \\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Azure Firewall Traffic\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Deny\",\"representation\":\"4\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"1\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RuleName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"BlankDashboard\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Allow\",\"color\":\"green\"},{\"columnName\":\"Deny\",\"color\":\"redBright\"}]}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Intrusion Prevention Systems (NS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-4-deploy-intrusion-detectionintrusion-prevention-systems-idsips)\\r\\n\\r\\nUse network intrusion detection and intrusion prevention systems (IDS/IPS) to inspect the network and payload traffic to or from your workload. Ensure that IDS/IPS is always tuned to provide high-quality alerts to your SIEM solution.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Firewall IDPS](https://docs.microsoft.com/azure/firewall/premium-features#idps)
\\r\\n💡 [Microsoft Defender for Endpoint capability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| extend IPS_Policy=strcat(\\\"IPS_Policy\\\")\\r\\n| project Action, IPS_Policy, SignatureID, Message, Protocol, SourceIP, SourcePort, DestIP, DestPort, TimeGenerated\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Intrusion Prevention Actions (Azure Firewall)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IPS_Policy\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"IPS Policy >>\",\"bladeOpenContext\":{\"bladeName\":\"FirewallManagerMenuBlade\",\"extensionName\":\"Microsoft_Azure_HybridNetworking\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"intrusion\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Intrusions\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy DDoS Protection (NS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-5-deploy-ddos-protection)\\r\\n\\r\\nDeploy distributed denial of service (DDoS) protection to protect your network and applications from attacks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/AzureDiagnostics) ✳️ [Azure DDoS Protection](https://azure.microsoft.com/services/ddos-protection/)
🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Manage Azure DDoS Protection Standard using the Azure portal](https://docs.microsoft.com/azure/virtual-network/manage-ddos-protection)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"dos\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Azure DDoS Plans\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"dos\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: DDoS\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Web Application Firewall (NS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-6-deploy-web-application-firewall)\\r\\n\\r\\nDeploy a web application firewall (WAF) and configure the appropriate rules to protect your web applications and APIs from application-specific attacks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter)🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to deploy Azure WAF](https://docs.microsoft.com/azure/web-application-firewall/overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Web Application Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies)
\"},\"name\":\"NS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"webapplicationfirewall\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Web Application Firewalls\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"WAF\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: WAF\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Simplify Network Security Configuration (NS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-7-simplify-network-security-configuration)\\r\\n\\r\\nWhen managing a complex network environment, use tools to simplify, centralize and enhance the network security management.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Adaptive Network Hardening in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-adaptive-network-hardening)
\\r\\n💡 [Azure Firewall Manager](https://docs.microsoft.com/azure/firewall-manager/overview)
\\r\\n💡 [Create an Azure Firewall and a firewall policy - ARM template](https://docs.microsoft.com/azure/firewall-manager/quick-firewall-policy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detect & Disable Insecure Services & Protocols (NS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-8-detect-and-disable-insecure-services-and--protocols)\\r\\n\\r\\nDetect and disable insecure services and protocols at the OS, application, or software package layer. Deploy compensating controls if disabling insecure services and protocols are not possible.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [SecurityEvent](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Sentinel insecure protocols workbook](https://docs.microsoft.com/azure/sentinel/quickstart-get-visibility#use-built-in-workbooks)
\\r\\n💡 [Conditional Access: Block legacy authentication](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Entra ID: Conditional Access](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.8\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let scEvents = dynamic([5827, 5828, 5829, 5830, 5831]);\\r\\nlet legacyAuth = SigninLogs\\r\\n| where ResultType == 0\\r\\n| where ClientAppUsed !contains \\\"Browser\\\" and ClientAppUsed !contains \\\"Mobile Apps and Desktop clients\\\"\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), Protocol=\\\"AAD Legacy Auth\\\";\\r\\nSecurityEvent\\r\\n| parse EventData with * '\\\"TicketEncryptionType\\\">' TicketEncryptionType '<' *\\r\\n| union Event\\r\\n| where (EventID == 2889) or (EventID == 3000 and EventLog == 'Microsoft-Windows-SMBServer/Audit') or (EventID == 4624 and AuthenticationPackageName == 'NTLM' and LmPackageName == 'NTLM V1' and Account !contains 'ANONYMOUS LOGON') or ((EventID == 4624 or EventID == 4776) and Level == 8 and PackageName contains 'WDigest') or (EventID == 4768 or EventID == 4769) and Level == 8 and (TicketEncryptionType != \\\"0x12\\\" and TicketEncryptionType != \\\"0x11\\\") or ((EventLog =~ \\\"System\\\" and Source =~ \\\"NETLOGON\\\") and EventID in (scEvents))\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), tostring(EventID)\\r\\n//| extend Protocol=replace(tostring(4776), 'WDigest', replace(tostring(4768), 'Kerberos weak cipher', replace(tostring(4769), 'Kerberos weak cipher', replace(tostring(2889), 'Insecure LDAP', replace(tostring(4624), 'NTLM v1', replace(tostring(3000), 'SMB v1', tostring(EventID)))))))\\r\\n| extend Protocol = case(EventID == 4776, \\\"WDigest\\\", EventID == 4768 or EventID == 4769, \\\"Weak Kerberos Cipher\\\", EventID == 2889, \\\"Insecure LDAP\\\", EventID == 4624, \\\"NTLM v1\\\", EventID == 3000, \\\"SMBv1\\\", EventID in (scEvents), \\\"Vulnerable Secure Channel\\\", \\\"Unknown\\\")\\r\\n| project Protocol, Count, TimeGenerated\\r\\n| union legacyAuth\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Insecure Protocols Count over Time (Microsoft Entra ID)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-S\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Passed\",\"color\":\"green\"},{\"seriesName\":\"Failed\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let scEvents = dynamic([5827, 5828, 5829, 5830, 5831]);\\r\\nlet legacyAuth = SigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| where ClientAppUsed !contains \\\"Browser\\\" and ClientAppUsed !contains \\\"Mobile Apps and Desktop clients\\\"\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), Protocol=\\\"AAD Legacy Auth\\\", UserPrincipalName, UserProfile, UserId;\\r\\nSecurityEvent\\r\\n| parse EventData with * '\\\"TicketEncryptionType\\\">' TicketEncryptionType '<' *\\r\\n| union Event\\r\\n| where (EventID == 2889) or (EventID == 3000 and EventLog == 'Microsoft-Windows-SMBServer/Audit') or (EventID == 4624 and AuthenticationPackageName == 'NTLM' and LmPackageName == 'NTLM V1' and Account !contains 'ANONYMOUS LOGON') or ((EventID == 4624 or EventID == 4776) and Level == 8 and PackageName contains 'WDigest') or (EventID == 4768 or EventID == 4769) and Level == 8 and (TicketEncryptionType != \\\"0x12\\\" and TicketEncryptionType != \\\"0x11\\\") or ((EventLog =~ \\\"System\\\" and Source =~ \\\"NETLOGON\\\") and EventID in (scEvents))\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), tostring(EventID), Account\\r\\n//| extend Protocol=replace(tostring(4776), 'WDigest', replace(tostring(4768), 'Kerberos weak cipher', replace(tostring(4769), 'Kerberos weak cipher', replace(tostring(2889), 'Insecure LDAP', replace(tostring(4624), 'NTLM v1', replace(tostring(3000), 'SMB v1', tostring(EventID)))))))\\r\\n| extend Protocol = case(EventID == 4776, \\\"WDigest\\\", EventID == 4768 or EventID == 4769, \\\"Weak Kerberos Cipher\\\", EventID == 2889, \\\"Insecure LDAP\\\", EventID == 4624, \\\"NTLM v1\\\", EventID == 3000, \\\"SMBv1\\\", EventID in (scEvents), \\\"Vulnerable Secure Channel\\\", \\\"Unknown\\\")\\r\\n| project Protocol, Count, Account, TimeGenerated\\r\\n| union legacyAuth\\r\\n| sort by Count desc\\r\\n| project Protocol, Count, UserPrincipalName, UserProfile, LastObserved=TimeGenerated, Account, UserId\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Insecure Protocol Details\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Protocol\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Connect On-Premises & Cloud Privately (NS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-9-connect-on-premises-or-cloud-network-privately)\\r\\n\\r\\nUse private connections for secure communication between different networks, such as cloud service provider data centers and on-premises infrastructure in a co-location environment.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/) ✳️ [Azure ExpressRoute](https://azure.microsoft.com/services/expressroute/) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure VPN overview](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways)
\\r\\n💡 [What are the ExpressRoute connectivity models](https://docs.microsoft.com/azure/expressroute/expressroute-connectivity-models)
\\r\\n💡 [Virtual network peering](https://docs.microsoft.com/azure/virtual-network/virtual-network-peering-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
\\r\\n🔀 [ExpressRoute](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits)
\\r\\n🔀 [Peerings](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Peering%2Fpeerings)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"express\\\" or type contains \\\"gateway\\\" or type contains \\\"peer\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Gateways, ExpressRoutes, Peerings\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isNS9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Domain Name System Security (NS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-10-ensure-domain-name-system-dns-security)\\r\\n\\r\\nEnsure that Domain Name System (DNS) security configuration protects against known risks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DNS](https://azure.microsoft.com/services/dns/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure DNS overview](https://docs.microsoft.com/azure/dns/dns-overview)
\\r\\n💡 [Secure Domain Name System (DNS) Deployment Guide](https://csrc.nist.gov/publications/detail/sp/800-81/2/final)
\\r\\n💡 [Azure Private DNS](https://docs.microsoft.com/azure/dns/private-dns-overview)
\\r\\n💡 [Azure Defender for DNS](https://docs.microsoft.com/azure/security-center/defender-for-dns-introduction)
\\r\\n💡 [Prevent dangling DNS entries and avoid subdomain takeover](https://docs.microsoft.com/azure/security/fundamentals/subdomain-takeover)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
\\r\\n🔀 [Private DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FprivateDnsZones)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.10\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"dns\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" DNS Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"dns\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: DNS\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS10Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Network Security (NS)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Identity Management (IM)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management) \\r\\n---\\r\\n\\r\\nIdentity Management covers controls to establish a secure identity and access controls using Microsoft Entra ID, including the use of single sign-on, strong authentications, managed identities (and service principles) for applications, conditional access, and account anomalies monitoring. \"},\"customWidth\":\"40\",\"name\":\"IM Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Centralized Identity & Authentication (IM-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Protect Identity & Authentication Systems (IM-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Manage App Identities Securely (IM-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Authenticate Server & Services (IM-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use SSO for App Access (IM-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"7e34d95b-a1fd-4326-a960-8c43a4afd9b4\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"85eac3da-ccbd-43cc-a9b3-cb41490ff565\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"7b658bf7-dbbc-4a85-90e4-4998bb428a38\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"271668c4-6655-43cd-ac75-2f1683932d4d\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Strong Authentication Controls (IM-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Restrict Resource Access Based on Conditions (IM-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Restrict the Exposure of Credentials & Secrets (IM-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure User Access to Existing Apps (IM-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM9\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5a3550b0-a5cc-40f2-8de4-c6eeb7613825\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"28277e0e-d51f-40a6-8552-2fbd5fe38fcf\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"53ff2b19-b478-4ebf-a112-82ef29db7fb9\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5b8d7037-4b7e-478a-a98e-73a24229c90d\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Centralized Identity & Authentication (IM-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-1-use-centralized-identity-and-authentication-system)\\r\\n\\r\\nUse a centralized identity and authentication system to govern your organization's identities and authentications for cloud and non-cloud resources.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID]( https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Tenancy in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/develop/single-and-multi-tenant-apps)
\\r\\n💡 [How to Create and Configure an Microsoft Entra ID Instance](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-access-create-new-tenant)
\\r\\n💡 [Define Microsoft Entra ID Tenants](https://azure.microsoft.com/resources/securing-azure-environments-with-azure-active-directory/)
\\r\\n💡 [Use External Identity Providers for An Application](https://docs.microsoft.com/azure/active-directory/external-identities/identity-providers)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = SigninLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastSignIn=TimeGenerated;\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, UserProfile, LastSignIn, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Review Valid Accounts\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Protect Identity & Authentication Systems (IM-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management?WT.mc_id=Portal-fx#im-2-protect-identity-and-authentication-systems)\\r\\n\\r\\nSecure your identity and authentication system as a high priority in your organization's cloud security practice.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [AADUserRiskEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aaduserriskevents) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What is the identity secure score in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/fundamentals/identity-secure-score)
\\r\\n💡 [Best Practices for Securing Active Directory](https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Microsoft Sentinel](https://ms.portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"name\":\"IM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Tactics contains \\\"access\\\" or Tactics contains \\\"elevate\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Identity \",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AADUserRiskEvents \\r\\n| extend RiskyUsers = strcat(\\\"https://ms.portal.azure.com/#blade/Microsoft_AAD_IAM/RiskyUsersBlade\\\")\\r\\n| summarize count() by UserPrincipalName, RiskLevel, RiskyUsers\\r\\n| extend Rank=iff(RiskLevel == \\\"high\\\", 3, iff(RiskLevel == \\\"medium\\\", 2, iff(RiskLevel == \\\"low\\\", 1, 0)))\\r\\n| where UserPrincipalName <> \\\"\\\"\\r\\n| project UserPrincipalName, RiskLevel, RiskyUsers, count_, Rank\\r\\n| sort by Rank,count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Risky Users\",\"noDataMessage\":\"Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and/or extend time thresholds for a larger data-set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RiskLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"high\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RiskyUsers\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Risky User Response >>\",\"bladeOpenContext\":{\"bladeName\":\"RiskyUsersBlade\",\"extensionName\":\"Microsoft_AAD_IAM\"}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Rank\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Manage Application Identities Securely (IM-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-3-manage-application-identities-securely-and-automatically)\\r\\n\\r\\nUse managed application identities instead of creating human accounts for applications to access resources and execute code. Managed application identities provide benefits such as reducing the exposure of credentials. Automate the rotation of credential to ensure the security of the identities.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AADManagedIdentitySignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadmanagedidentitysigninlogs) 🔷 [AADServicePrincipalSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Managed Identities](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview)
\\r\\n💡 [Services that Support Managed Identities for Azure Resources](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities)
\\r\\n💡 [Azure Service Principal](https://docs.microsoft.com/powershell/azure/create-azure-service-principal-azureps)
\\r\\n💡 [Create a Service Principal with Certificates](https://docs.microsoft.com/azure/active-directory/develop/howto-authenticate-service-principal-powershell)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Managed Identities](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.ManagedIdentity%2FuserAssignedIdentities)
\\r\\n🔀 [App Registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADManagedIdentitySignInLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by ServicePrincipalName\\r\\n| project ServicePrincipalName, LastSignIn=TimeGenerated;\\r\\nAADManagedIdentitySignInLogs\\r\\n| extend ManagedIdentities = strcat(\\\"Managed Identities\\\")\\r\\n| where ResultType == 0\\r\\n| summarize count() by ServicePrincipalName, ManagedIdentities\\r\\n| join (LastObserved) on ServicePrincipalName\\r\\n| project ServicePrincipalName, SignInCount=count_, ManagedIdentities, LastSignIn\\r\\n| sort by SignInCount desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Managed Identity Actions\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ServicePrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ManagedIdentities\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Managed Identities >>\",\"bladeOpenContext\":{\"bladeName\":\"BrowseResource\",\"extensionName\":\"HubsExtension\",\"bladeParameters\":[{\"name\":\"resourceType\",\"source\":\"static\",\"value\":\"Microsoft.ManagedIdentity/userAssignedIdentities\"}]}}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADServicePrincipalSignInLogs \\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by ServicePrincipalName\\r\\n| project ServicePrincipalName, LastSignIn=TimeGenerated;\\r\\nAADServicePrincipalSignInLogs \\r\\n| extend ServicePrincipals = strcat(\\\"Service Principals\\\")\\r\\n| where ResultType == 0\\r\\n| summarize count() by ServicePrincipalName, ServicePrincipals\\r\\n| join (LastObserved) on ServicePrincipalName\\r\\n| project ServicePrincipalName, SignInCount=count_, ServicePrincipals, LastSignIn\\r\\n| sort by SignInCount desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Service Principal Actions\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ServicePrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"green\"}},{\"columnMatch\":\"ServicePrincipals\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Service Principals >>\",\"bladeOpenContext\":{\"bladeName\":\"ActiveDirectoryMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\"}}},{\"columnMatch\":\"ManagedIdentities\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Managed Identities >>\",\"bladeOpenContext\":{\"bladeName\":\"BrowseResource\",\"extensionName\":\"HubsExtension\",\"bladeParameters\":[{\"name\":\"resourceType\",\"source\":\"static\",\"value\":\"Microsoft.ManagedIdentity/userAssignedIdentities\"}]}}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Authenticate Server and Services (IM-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-4-authenticate-server-and-services)\\r\\n\\r\\nAuthenticate remote servers and services from your client side to ensure you are connecting to trusted server and services. The most common server authentication protocol is Transport Layer Security (TLS), where the client-side (often a browser or client device) verifies the server by verifying the server’s certificate was issued by a trusted certificate authority. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Enforce Transport Layer Security (TLS) for a storage account](https://docs.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal#use-azure-policy-to-enforce-the-minimum-tls-version)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| where RecommendationName contains \\\"TLS\\\" or RecommendationName contains \\\"Auth\\\" or RecommendationName contains \\\"JIT\\\" or RecommendationName contains \\\"access\\\"\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Single Sign-on (SSO) for Application Access (IM-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-5-use-single-sign-on-sso-for-application-access)\\r\\n\\r\\nUse single sign-on (SSO) to simplify the user experience for authenticating to resources including applications and data across cloud services and on-premises environments. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AADNonInteractiveUserSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Application SSO with Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/manage-apps/what-is-single-sign-on)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADNonInteractiveUserSignInLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastSignIn=TimeGenerated;\\r\\nAADNonInteractiveUserSignInLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, UserProfile, LastSignIn, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"SSO Activity by Non-Interactive Sign-ins\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Strong Authentication Controls (IM-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-6-use-strong-authentication-controls)\\r\\n\\r\\nEnforce strong authentication controls (strong password-less authentication or multi-factor authentication) with your centralized identity and authentication management system for all access to resources. Authentication based on password credentials alone is considered legacy, as it is insecure and does not stand up to popular attack methods.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable MFA in Azure](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted)
\\r\\n💡 [Introduction to Password-less Authentication Options for Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless)
\\r\\n💡 [Microsoft Entra ID Default Password Policy](https://docs.microsoft.com/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts)
\\r\\n💡 [Eliminate Bad Passwords Using Microsoft Entra ID Password Protection](https://docs.microsoft.com/azure/active-directory/authentication/concept-password-ban-bad)
\\r\\n💡 [Block legacy authentication](https://docs.microsoft.com/azure/active-directory/conditional-access/block-legacy-authentication)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MFAFailures = SigninLogs\\r\\n| where AuthenticationRequirement == \\\"multiFactorAuthentication\\\"\\r\\n| where ResultType <> 0\\r\\n| extend FailureReason = tostring(Status.failureReason)\\r\\n| where FailureReason contains \\\"User did not pass the MFA\\\"\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| summarize count() by UserPrincipalName, UserId, UserProfile\\r\\n| extend FailedMFACount=count_;\\r\\nlet LastObserved = SigninLogs\\r\\n| where ResultType <> 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastFailedSignIn=TimeGenerated;\\r\\nSigninLogs\\r\\n| where AuthenticationRequirement == \\\"multiFactorAuthentication\\\"\\r\\n| where ResultType <> 0\\r\\n| extend FailureReason = tostring(Status.failureReason)\\r\\n| where FailureReason contains \\\"User did not pass the MFA\\\"\\r\\n| make-series Trend = dcount(FailureReason) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserPrincipalName\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| join (MFAFailures) on UserPrincipalName\\r\\n| project UserPrincipalName, UserProfile, FailedMFACount, Trend, LastFailedSignIn, UserId\\r\\n| sort by FailedMFACount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Monitor User MFA Failures\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"FailedMFACount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"UserId\",\"formatter\":5}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Restrict Resource Access Based on Conditions (IM-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions)\\r\\n\\r\\nExplicitly validate trusted signals to allow or deny user access to resources, as part of a zero-trust access model. Signals to validate should include strong authentication of user account, behavioral analytics of user account, device trustworthiness, user or group membership, locations and so on.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Conditional Access Overview](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\\r\\n💡 [Common Conditional Access Policies](https://docs.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common)
\\r\\n💡 [Conditional Access insights and reporting](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting)
\\r\\n💡 [Configure Authentication Session Management with Conditional Access](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra Id](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let nonInteractive = AADNonInteractiveUserSignInLogs\\r\\n| extend LocationDetails = parse_json(LocationDetails)\\r\\n| extend Status = parse_json(Status)\\r\\n| extend ConditionalAccessPolicies = parse_json(ConditionalAccessPolicies);\\r\\nlet data = \\r\\nunion SigninLogs,nonInteractive\\r\\n|extend CAStatus = case(ConditionalAccessStatus ==\\\"success\\\",\\\"Successful\\\",\\r\\n ConditionalAccessStatus == \\\"failure\\\", \\\"Failed\\\", \\r\\n ConditionalAccessStatus == \\\"notApplied\\\", \\\"Not applied\\\", \\r\\n isempty(ConditionalAccessStatus), \\\"Not applied\\\", \\r\\n \\\"Disabled\\\")\\r\\n|mvexpand ConditionalAccessPolicies\\r\\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\\r\\n|extend CAGrantControl = case(CAGrantControlName contains \\\"MFA\\\", \\\"Require MFA\\\", \\r\\n CAGrantControlName contains \\\"Terms of Use\\\", \\\"Require Terms of Use\\\", \\r\\n CAGrantControlName contains \\\"Privacy\\\", \\\"Require Privacy Statement\\\", \\r\\n CAGrantControlName contains \\\"Device\\\", \\\"Require Device Compliant\\\", \\r\\n CAGrantControlName contains \\\"Azure AD Joined\\\", \\\"Require Hybrid Azure AD Joined Device\\\", \\r\\n CAGrantControlName contains \\\"Apps\\\", \\\"Require Approved Apps\\\",\\r\\n \\\"Other\\\");\\r\\ndata\\r\\n| summarize Count = dcount(Id) by CAStatus\\r\\n| join kind = inner (data\\r\\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus\\r\\n ) on CAStatus\\r\\n| project-away CAStatus1, TimeGenerated\\r\\n| order by Count desc\",\"size\":4,\"showAnalytics\":true,\"title\":\" Conditional Access Status \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"CAStatus\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Category\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SigninLogs\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by ConditionalAccessStatus\\r\\n| render areachart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Conditional Access Status over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"notApplied\",\"color\":\"red\"},{\"seriesName\":\"success\",\"color\":\"greenDark\"}]}},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Restrict Exposure of Credentials & Secrets (IM-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-8-restrict-the-exposure-of-credential-and-secrets)\\r\\n\\r\\nEnsure that application developers securely handle credentials and secrets\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Setup Credential Scanner](https://secdevtools.azurewebsites.net/helpcredscan.html)
\\r\\n💡 [GitHub Secret Scanning](https://docs.github.com/github/administering-a-repository/about-secret-scanning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityAlert\\r\\n| where AlertName contains \\\"secret\\\" or AlertName contains \\\"cred\\\" or AlertName contains \\\"password\\\" or AlertName contains \\\"auth\\\" or AlertName contains \\\"cert\\\"\\r\\n| summarize count() by AlertName\\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Security Alerts for Credentials \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"secret\\\" or Title contains \\\"cred\\\" or Title contains \\\"password\\\" or Title contains \\\"auth\\\" or Title contains \\\"cert\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Secrets & Credentials\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure User Access to Existing Applications (IM-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-9-secure-user-access-to--existing-applications)\\r\\n\\r\\nIn a hybrid environment, where you have on-premises applications or non-native cloud applications using legacy authentication, consider solutions such as cloud access security broker (CASB), application proxy, single sign-on (SSO) to govern the access to these applications. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Entra ID Application Proxy](https://learn.microsoft.com/en-us/entra/identity/app-proxy/overview-what-is-app-proxy)
\\r\\n💡 [Microsoft Defender for Cloud Apps Best Practices](https://docs.microsoft.com/cloud-app-security/best-practices)
\\r\\n💡 [Microsoft Entra ID secure hybrid access](https://docs.microsoft.com/azure/active-directory/manage-apps/secure-hybrid-access)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"app\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Applications\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-9\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Identity Management (IM)\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Identity Management (IM)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Privileged Access (PA)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access) \\r\\n---\\r\\nPrivileged Access covers controls to protect privileged access to your Azure tenant and resources, including a range of controls to protect your administrative model, administrative accounts, and privileged access workstations against deliberate and inadvertent risk. \"},\"customWidth\":\"40\",\"name\":\"PA Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Separate & Limit Highly Privileged Users (PA-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Avoid Standing Access for Accounts (PA-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Manage Lifecycle of Identities & Entitlements (PA-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Review User Access Regularly (PA-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"dbe2ebfe-02aa-4e6c-bd33-d134fe277f73\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"8e735a1c-34be-4429-a6d5-ea7754b5450d\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"8138f796-7f6a-45c4-acb3-40be84faf4d3\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Setup Emergency Access (PA-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Privileged Access Workstations (PA-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Follow Just Enough Administration Principle (PA-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Determine Access Process for Support (PA-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA8\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f359d341-8d40-4cfb-8275-ad22d8424aa2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9d3bb081-76b4-48c9-a8bf-12fef2889550\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"184c2260-e070-4898-8a28-53695c294fe4\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6cc54ea3-a296-4221-ba1a-5999de049ca2\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Separate & Limit Highly Privileged Users (PA-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users)\\r\\n\\r\\nEnsure you are identifying all high business impact accounts. Limit the number of privileged/administrative accounts in your cloud's control plane, management plane and data/workload plane. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Administrator Role Permissions in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/permissions-reference)
\\r\\n💡 [Use Azure Privileged Identity Management Security Alerts](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts)
\\r\\n💡 [Securing Privileged Access for Hybrid and Cloud Deployments in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/security-planning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Privileged Identity Management](https://ms.portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\"},\"name\":\"PA-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AuditLogs\\r\\n| where OperationName contains \\\"PIM\\\"\\r\\n| extend PIM = strcat(\\\"https://ms.portal.azure.com/#blade/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/aadmigratedroles\\\")\\r\\n| distinct OperationName, PIM, Identity, AADOperationType, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Privileged Identity Management (PIM) Elevations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"pending\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"PIM\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"PIM >>\",\"linkIsContextBlade\":false,\"bladeOpenContext\":{\"bladeName\":\"MyAuditsMenuBlade\",\"extensionName\":\"Microsoft_Azure_PIMCommon\"}}},{\"columnMatch\":\"Identity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"GrantedTo\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go To: Entra ID Profile >\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Avoid Standing Access for Accounts (PA-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-2-avoid-standing-access-for-user-accounts-and-permissions)\\r\\n\\r\\nInstead of creating standing privileges, use just-in-time (JIT) mechanism to assign privileged access to the different resource tiers.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure PIM just-in-time access deployment](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Manage Lifecycle of Identities & Entitlements (PA-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-3-manage-lifecycle-of-identities-and-entitlements)\\r\\n\\r\\nUse an automated process or technical control to manage the identity and access lifecycle including the request, review, approval, provision, and deprovision.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What are Microsoft Entra ID access reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n💡 [What is Microsoft Entra ID entitlement management](https://docs.microsoft.com/azure/active-directory/governance/entitlement-management-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Identity Governance](https://ms.portal.azure.com/#blade/Microsoft_AAD_ERM/DashboardBlade/GettingStarted)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Roles = IdentityInfo\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName=AccountUPN\\r\\n| project UserPrincipalName, AssignedRoles=strcat(AssignedRoles), GroupMemberships=strcat(GroupMembership);\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (Roles) on UserPrincipalName\\r\\n| project UserPrincipalName, UserProfile, AssignedRoles, GroupMemberships, UserId\\r\\n| sort by UserPrincipalName asc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Review User Roles and Groups\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"LastSignIn\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"SignInsBeforeInactive\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":2500,\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Review & Reconcile User Access Regularly (PA-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-4-review-and-reconcile-user-access-regularly)\\r\\n\\r\\nConduct regular review of privileged account entitlements. Ensure the access granted to the accounts is valid for administration of control plane, management plane, and workloads.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Create an access review of Azure resource roles in Privileged Identity Management (PIM)](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-resource-roles-start-access-review)
\\r\\n💡 [How to use Microsoft Entra ID identity and access reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n\\r\\n### Microsoft Portal\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"Account\\\" or Title contains \\\"User\\\" or Title contains \\\"Identity\\\" or Title contains \\\"Login\\\" or Title contains \\\"Sign\\\" or Title contains \\\"travel\\\" or Title contains \\\"impersonate\\\" or Title contains \\\"AAD\\\" or Title contains \\\"service principal\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: User Access\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Setup Emergency Access (PA-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-set-up-emergency-access)\\r\\n\\r\\nSet up emergency access to ensure that you are not accidentally locked out of your critical cloud infrastructure (such as your identity and access management system) in an emergency.\\r\\n\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Manage Emergency Access Accounts in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/security-emergency-access)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Roles = IdentityInfo\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName=AccountUPN\\r\\n| project UserPrincipalName, AssignedRoles=strcat(AssignedRoles), GroupMemberships=strcat(GroupMembership);\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (Roles) on UserPrincipalName\\r\\n| where AssignedRoles contains \\\"security\\\" or AssignedRoles contains \\\"admin\\\" or GroupMemberships contains \\\"security\\\" or GroupMemberships contains \\\"admin\\\"\\r\\n| project UserPrincipalName, UserProfile, SignInCount=count_, AssignedRoles, GroupMemberships, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Designate Emergency Accounts & Monitor Access\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"LastSignIn\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SignInsBeforeInactive\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":2500,\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Privileged Access Workstations (PA-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-6-use-privileged-access-workstations)\\r\\n\\r\\nSecured, isolated workstations are critically important for the security of sensitive roles like administrator, developer, and critical service operator.\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Privileged Access Workstations](https://docs.microsoft.com/security/compass/privileged-access-deployment)
\\r\\n\\r\\n### Microsoft Portal\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## [Privileged Access Deployment](https://docs.microsoft.com/security/compass/privileged-access-deployment)\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isPA6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Follow Just Enough Administration Principle (PA-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle)\\r\\n\\r\\nFollow the just enough administration (least privilege) principle to manage permissions at fine-grained level. Use features such as role-based access control (RBAC) to manage resource access through role assignments.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Activity]( https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What is Azure Role-Based Access Control (Azure RBAC)](https://docs.microsoft.com/azure/role-based-access-control/overview)
\\r\\n💡 [How to Configure Azure RBAC](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal)
\\r\\n💡 [How to Use Microsoft Entra ID Identity and Access Reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AuditLogs\\r\\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\\r\\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\\r\\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of successful operations against the total\\r\\n| project OperationName, Runs, SuccessRate, Fails\\r\\n| sort by Runs desc\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Monitor Privileged User Operations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Runs\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"SuccessRate\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redGreen\"}},{\"columnMatch\":\"Fails\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"UserId\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"resource\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"OfficeWorkload\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"resource\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_heatmap_Fails_3\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_heatmap_Fails_3\",\"sortOrder\":1}]},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = AuditLogs\\r\\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\\r\\n | where \\\"All\\\" == \\\"All\\\" or Result in ('All')\\r\\n | extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\")\\r\\n | where \\\"All\\\" == \\\"All\\\" or initiator in ('All')\\r\\n | where \\\"All\\\" == \\\"All\\\" or Category in ('All')\\r\\n | where Category == 'All' or 'All' == \\\"All\\\";\\r\\nlet appData = data\\r\\n | summarize TotalCount = count() by OperationName, Category\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName\\r\\n | project-away TimeGenerated)\\r\\n on OperationName\\r\\n | order by TotalCount desc, OperationName asc\\r\\n | project OperationName, TotalCount, Trend, Category\\r\\n | serialize Id = row_number();\\r\\ndata\\r\\n| summarize TotalCount = count() by initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\"), Category, OperationName\\r\\n| join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName, initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\")\\r\\n | project-away TimeGenerated)\\r\\n on OperationName, initiator\\r\\n| order by TotalCount desc, OperationName asc\\r\\n| project OperationName, initiator, TotalCount, Category, Trend\\r\\n| serialize Id = row_number(1000000)\\r\\n| join kind=inner (appData) on OperationName\\r\\n| project Id, Name = initiator, Type = 'initiator', ['Operations Count'] = TotalCount, Trend, ParentId = Id1\\r\\n| union (appData \\r\\n | project Id, Name = OperationName, Type = 'Operation', ['Operations Count'] = TotalCount, Trend)\\r\\n| order by ['Operations Count'] desc, Name asc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Monitor Privileged User Activities\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"UserInfo\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Type\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Operations Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"ParentId\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\"}},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Determine Access Process for Support (PA-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-8-determine-access-process-for-cloud-provider-support)\\r\\n\\r\\nEstablish an approval process and access path for requesting and approving vendor support request and temporary access to your data through a secure channel.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Customer Lockbox](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Customer Lockbox](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\\r\\n💡 [Establish Approval Process for Vendor Support Access with Azure Lockbox](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/ActivityLog)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Customer Lockbox](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationName contains \\\"lockbox\\\"\\r\\n| sort by TimeGenerated desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Customer Lockbox Activity\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"info\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Privileged Access Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Data Protection (DP)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection) \\r\\n---\\r\\nData Protection covers control of data protection at rest, in transit, and via authorized access mechanisms, including discover, classify, protect, and monitor sensitive data assets using access control, encryption, and logging in Azure.\"},\"customWidth\":\"40\",\"name\":\"DP Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Discover, Classify, & Label Sensitive Data (DP-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Monitor Anomalies & Threats Targeting Sensitive Data (DP-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Encrypt Sensitive Data in Transit (DP-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Data at Rest Encryption by Default (DP-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1ecc3fc5-0702-423d-9bb8-5655a8dfbbeb\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"17084acc-f6d3-468e-acf2-b8495a892526\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e3ffa459-386a-4c1e-925f-49f2fa7abeee\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Customer-Managed Keys (DP-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Secure Key Management (DP-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Secure Certificate Management (DP-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Security of Key & Certificate Repository (DP-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP8\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"dcbe4289-9536-4684-92a1-1b8ab38ae4d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7989a6c0-1e87-4b65-bcd5-5825349ec18c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"3bc5bd51-d93c-4c6c-9cd2-36f5b0b96443\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"892d1c80-5dd4-4937-9527-36b21bf9eacf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Discover, Classify, & Label Sensitive Data (CP-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-1-discover-classify-and-label-sensitive-data)\\r\\n\\r\\nEstablish and maintain an inventory of the sensitive data, based on the defined sensitive data scope. Use tools to discover, classify and label the in- scope sensitive data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Data classification overview](https://docs.microsoft.com/azure/cloud-adoption-framework/govern/policy-compliance/data-classification)
\\r\\n💡 [Label your sensitive data using Azure Purview](https://docs.microsoft.com/azure/purview/create-sensitivity-label)
\\r\\n💡 [Tag Sensitive Information Using Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\\r\\n💡 [How to implement Azure SQL Data Discovery](https://docs.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview)
\\r\\n💡 [Azure Purview data sources](https://docs.microsoft.com/azure/purview/purview-connector-overview#purview-data-sources)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InformationProtectionLogs_CL\\r\\n| extend AIP = strcat(\\\"https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/ActivityLogsBlade\\\")\\r\\n| summarize count() by LabelName_s, AIP\\r\\n| sort by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Data Labeling via Azure Information Protection\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LabelName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AIP\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Azure Information Protection >>\",\"bladeOpenContext\":{\"bladeName\":\"DataClassGroupEditBlade\",\"extensionName\":\"Microsoft_Azure_InformationProtection\"}}},{\"columnMatch\":\"User\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProtectionOwner\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}},{\"columnMatch\":\"UserId_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProductName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"UPN\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Incident >\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"city_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"state_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Monitor Anomalies & Threats Targeting Sensitive Data (DP-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-2-monitor-anomalies-and-threats-targeting-sensitive-data)\\r\\n\\r\\nMonitor for anomalies around sensitive data, such as unauthorized transfer of data to locations outside of enterprise visibility and control. This typically involves monitoring for anomalous activities (large or unusual transfers) that could indicate unauthorized data exfiltration.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Enable Azure Defender for SQL](https://docs.microsoft.com/azure/azure-sql/database/azure-defender-for-sql)
\\r\\n💡 [Enable Azure Defender for Storage](https://docs.microsoft.com/azure/storage/common/storage-advanced-threat-protection?tabs=azure-security-center)
\\r\\n\\r\\n### Microsoft Logs\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"data\\\" or Title contains \\\"access\\\" or Title contains \\\"sensitive\\\" or Tactics == \\\"exfiltration\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Sensitive Data\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Encrypt Sensitive Data in Transit (DP-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-3-encrypt-sensitive-data-in-transit)\\r\\n\\r\\nProtect the data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Double encryption for Azure data in transit](https://docs.microsoft.com/azure/security/fundamentals/double-encryption#data-in-transit)
\\r\\n💡 [Understand encryption in transit with Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
\\r\\n💡 [Information on TLS Security](https://docs.microsoft.com/security/engineering/solving-tls1-problem)
\\r\\n💡 [Enforce secure transfer in Azure storage](https://docs.microsoft.com/azure/storage/common/storage-require-secure-transfer?toc=/azure/storage/blobs/toc.json#require-secure-transfer-for-a-new-storage-account)
\\r\\n\\r\\n## Microsoft Portals \\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Data at Rest Encryption by Default (DP-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-4-enable-data-at-rest-encryption-by-default)\\r\\n\\r\\nTo complement access controls, data at rest should be protected against 'out of band' attacks (such as accessing underlying storage) using encryption. This helps ensure that attackers cannot easily read or modify the data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Encryption at Rest in Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest#encryption-at-rest-in-microsoft-cloud-services)
\\r\\n💡 [Data at Rest Double Encryption in Azure](https://docs.microsoft.com/azure/security/fundamentals/double-encryption#data-at-rest)
\\r\\n💡 [Encryption Model and Key Management Table](https://docs.microsoft.com/azure/security/fundamentals/encryption-models)
\\r\\n💡 [Security architecture](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Customer-Managed Key Option in Data at Rest Encryption When Required (DP-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required)\\r\\n\\r\\nIf required for regulatory compliance, define the use case and service scope where customer-managed key option is needed. Enable and implement data at rest encryption using customer-managed key in services. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Encryption model and key management table](https://docs.microsoft.com/azure/security/fundamentals/encryption-models)
\\r\\n💡 [Services that support encryption using customer-managed key](https://docs.microsoft.com/azure/security/fundamentals/encryption-models#supporting-services)
\\r\\n💡 [How to configure customer managed encryption keys in Azure Storage](https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use a Secure Key Management Process (DP-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-6-use-a-secure-key-management-process)\\r\\n\\r\\nDocument and implement an enterprise cryptographic key management standard, processes, and procedures to control your key lifecycle. When there is a need to use customer-managed key in the services, use a secured key vault service for key generation, distribution, and storage. Rotate and revoke your keys based on the defined schedule and when there is a key retirement or compromise.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Key Vault overview](https://docs.microsoft.com/azure/key-vault/general/overview)
\\r\\n💡 [Azure data encryption at rest--Key Hierarchy](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest#key-hierarchy)
\\r\\n💡 [BYOK (Bring Your Own Key) specification](https://docs.microsoft.com/azure/key-vault/keys/byok-specification)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Run query to see results.\\r\\nresources\\r\\n| where type =~ 'Microsoft.KeyVault/vaults'\\r\\n| project name,resourceGroup,location,id,type,subscriptionId,kind,tags\\r\\n| extend typeDisplayName=case(type =~ 'microsoft.keyvault/vaults','Key vault',type)\\r\\n| extend locationDisplayName=case(location =~ 'eastus','East US',location =~ 'eastus2','East US 2',location =~ 'southcentralus','South Central US',location =~ 'westus2','West US 2',location =~ 'westus3','West US 3',location =~ 'australiaeast','Australia East',location =~ 'southeastasia','Southeast Asia',location =~ 'northeurope','North Europe',location =~ 'swedencentral','Sweden Central',location =~ 'uksouth','UK South',location =~ 'westeurope','West Europe',location =~ 'centralus','Central US',location =~ 'northcentralus','North Central US',location =~ 'westus','West US',location =~ 'southafricanorth','South Africa North',location =~ 'centralindia','Central India',location =~ 'eastasia','East Asia',location =~ 'japaneast','Japan East',location =~ 'jioindiawest','Jio India West',location =~ 'koreacentral','Korea Central',location =~ 'canadacentral','Canada Central',location =~ 'francecentral','France Central',location =~ 'germanywestcentral','Germany West Central',location =~ 'norwayeast','Norway East',location =~ 'switzerlandnorth','Switzerland North',location =~ 'uaenorth','UAE North',location =~ 'brazilsouth','Brazil South',location =~ 'centralusstage','Central US (Stage)',location =~ 'eastusstage','East US (Stage)',location =~ 'eastus2stage','East US 2 (Stage)',location =~ 'northcentralusstage','North Central US (Stage)',location =~ 'southcentralusstage','South Central US (Stage)',location =~ 'westusstage','West US (Stage)',location =~ 'westus2stage','West US 2 (Stage)',location =~ 'asia','Asia',location =~ 'asiapacific','Asia Pacific',location =~ 'australia','Australia',location =~ 'brazil','Brazil',location =~ 'canada','Canada',location =~ 'europe','Europe',location =~ 'france','France',location =~ 'germany','Germany',location =~ 'global','Global',location =~ 'india','India',location =~ 'japan','Japan',location =~ 'korea','Korea',location =~ 'norway','Norway',location =~ 'southafrica','South Africa',location =~ 'switzerland','Switzerland',location =~ 'uae','United Arab Emirates',location =~ 'uk','United Kingdom',location =~ 'unitedstates','United States',location =~ 'eastasiastage','East Asia (Stage)',location =~ 'southeastasiastage','Southeast Asia (Stage)',location =~ 'westcentralus','West Central US',location =~ 'southafricawest','South Africa West',location =~ 'australiacentral','Australia Central',location =~ 'australiacentral2','Australia Central 2',location =~ 'australiasoutheast','Australia Southeast',location =~ 'japanwest','Japan West',location =~ 'jioindiacentral','Jio India Central',location =~ 'koreasouth','Korea South',location =~ 'southindia','South India',location =~ 'westindia','West India',location =~ 'canadaeast','Canada East',location =~ 'francesouth','France South',location =~ 'germanynorth','Germany North',location =~ 'norwaywest','Norway West',location =~ 'switzerlandwest','Switzerland West',location =~ 'ukwest','UK West',location =~ 'uaecentral','UAE Central',location =~ 'brazilsoutheast','Brazil Southeast',location)\\r\\n| extend tagsString=tostring(tags)\\r\\n| where (type !~ ('dynatrace.observability/monitors'))\\r\\n| where (type !~ ('nginx.nginxplus/nginxdeployments'))\\r\\n| where (type !~ ('microsoft.agfoodplatform/farmbeats'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/customdomains'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/origingroups'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/rulesets'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/secrets'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/securitypolicies'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints/routes'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/origingroups/origins'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/rulesets/rules'))\\r\\n| where (type !~ ('microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\\r\\n| where (type !~ ('microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\\r\\n| where (type !~ ('microsoft.portal/extensions/deployments'))\\r\\n| where (type !~ ('microsoft.portal/extensions'))\\r\\n| where (type !~ ('microsoft.portal/extensions/slots'))\\r\\n| where (type !~ ('microsoft.portal/extensions/versions'))\\r\\n| where (type !~ ('microsoft.datacollaboration/workspaces'))\\r\\n| where (type !~ ('microsoft.network/dnsforwardingrulesets'))\\r\\n| where (type !~ ('microsoft.network/dnsresolvers'))\\r\\n| where (type !~ ('microsoft.azurestack/registrations'))\\r\\n| where (type !~ ('microsoft.communication/emailservices'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters/sessionclusters'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools'))\\r\\n| where (type !~ ('microsoft.hpcworkbench/instances'))\\r\\n| where (type !~ ('microsoft.scvmm/vmmservers'))\\r\\n| where (type !~ ('microsoft.connectedvmwarevsphere/vcenters'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/assets'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/tests'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/executionplans'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/testplans'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins'))\\r\\n| where not((type =~ ('microsoft.network/serviceendpointpolicies')) and ((kind =~ ('internal'))))\\r\\n| where (type !~ ('microsoft.openlogisticsplatform/workspaces'))\\r\\n| where (type !~ ('microsoft.scom/managedinstances'))\\r\\n| where (type !~ ('microsoft.orbital/spacecrafts/contacts'))\\r\\n| where (type !~ ('microsoft.orbital/contactprofiles'))\\r\\n| where (type !~ ('microsoft.orbital/edgesites'))\\r\\n| where (type !~ ('microsoft.orbital/groundstations'))\\r\\n| where (type !~ ('microsoft.orbital/l2connections'))\\r\\n| where (type !~ ('microsoft.orbital/spacecrafts'))\\r\\n| where (type !~ ('microsoft.azurepercept/accounts'))\\r\\n| where (type !~ ('microsoft.workloads/phpworkloads'))\\r\\n| where (type !~ ('microsoft.playfab/playeraccountpools'))\\r\\n| where (type !~ ('microsoft.playfab/playfabresources'))\\r\\n| where (type !~ ('microsoft.playfab/titles'))\\r\\n| where (type !~ ('microsoft.recommendationsservice/accounts/modeling'))\\r\\n| where (type !~ ('microsoft.recommendationsservice/accounts/serviceendpoints'))\\r\\n| where (type !~ ('microsoft.recoveryservicesbvtd2/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesbvtd/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesintd/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesintd2/vaults'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/applicationinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/centralinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/databaseinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances'))\\r\\n| where (type !~ ('microsoft.datareplication/replicationvaults'))\\r\\n| where (type !~ ('microsoft.storagecache/amlfilesystems'))\\r\\n| where not((type =~ ('microsoft.synapse/workspaces/sqlpools')) and ((kind =~ ('v3'))))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/sites'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/packetcorecontrolplanes'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/services'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/sims'))\\r\\n| where (type !~ ('microsoft.workloads/monitors'))\\r\\n| where not((type =~ ('microsoft.sql/servers/databases')) and ((kind in~ ('system','v2.0,system','v12.0,system','v12.0,user,datawarehouse,gen2,analytics'))))\\r\\n| where not((type =~ ('microsoft.sql/servers')) and ((kind =~ ('v12.0,analytics'))))\\r\\n| project id,typeDisplayName,resourceGroup,locationDisplayName,tagsString,name,type,kind,location,subscriptionId,tags\\r\\n| sort by (tolower(tostring(name))) asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use a Secure Certificate Management Process (DP-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-7-use-a-secure-certificate-management-process)\\r\\n\\r\\nDocument and implement an enterprise certificate management standard, processes and procedures which includes the certificate lifecycle control, and certificate policies (if a public key infrastructure is needed). \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n \\r\\n## Implementation\\r\\n💡 [Get started with Key Vault certificates](https://docs.microsoft.com/azure/key-vault/certificates/certificate-scenarios)
\\r\\n💡 [Certificate Access Control in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/certificate-access-control)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n💡 [Security architecture](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"key\\\" or Title contains \\\"certificate\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Keys & Certificates\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Security of Key & Certificate Repository (DP-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-8-ensure-security-of-key-and-certificate-repository)\\r\\n\\r\\nEnsure the security of the key vault service used for the cryptographic key and certificate lifecycle management. Harden your key vault service through access control, network security, logging and monitoring and backup to ensure keys and certificates are always protected using the maximum security.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)\\r\\n \\r\\n## Implementation\\r\\n💡 [Azure Key Vault overview](https://docs.microsoft.com/azure/key-vault/general/overview)
\\r\\n💡 [Azure Key Vault security best practices](https://docs.microsoft.com/azure/key-vault/general/best-practices)
\\r\\n💡 [Use managed identity to access Azure Key Vault](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.8\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity \\r\\n| where OperationNameValue startswith \\\"Microsoft.KeyVault\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault: Access & Policy Changes\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 7 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceProvider == \\\"MICROSOFT.KEYVAULT\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 100\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault: Operations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":100,\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Data Protection Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Asset Management (AM)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management) \\r\\n---\\r\\nAsset Management covers controls to ensure security visibility and governance over Azure resources, including recommendations on permissions for security personnel, security access to asset inventory, and managing approvals for services and resources (inventory, track, and correct). \"},\"customWidth\":\"40\",\"name\":\"AM Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"A\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Track Asset Inventory & Risks (AM-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Only Approved Services (AM-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Security of Asset Lifecycle Management (AM-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Limit Access to Asset Management (AM-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Only Approved Apps in Virtual Machine (AM-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"3b5c2b30-6e56-4326-9416-89041b15e51a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"262d5814-d29c-45a0-bb16-6506c0e315fe\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1765861c-fdf7-4445-9378-9996ac409814\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5da235d1-704b-478b-9325-e2aa8d5458ee\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Track Asset Inventory & Risks (AM-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-1-track-asset-inventory-and-their-risks)\\r\\n\\r\\nTrack your asset inventory by query and discover all your cloud resources. Logically organize your assets by tagging and grouping your assets based on their service nature, location, or other characteristics. Ensure your security organization has access to a continuously updated inventory of assets.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Create Queries with Azure Resource Graph Explorer](https://docs.microsoft.com/azure/governance/resource-graph/first-query-portal)
\\r\\n💡 [Microsoft Defender for Cloud Asset Inventory Management](https://docs.microsoft.com/azure/security-center/asset-inventory)
\\r\\n💡 [For More Information About Tagging Assets, See the Resource Naming and Tagging Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=%2fazure%2fazure-resource-manager%2fmanagement%2ftoc.json)
\\r\\n💡 [Overview of Security Reader Role](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#security-reader)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud: Inventory](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/25)
\\r\\n🔀 [Microsoft Defender XDR: Software Inventory](https://security.microsoft.com/software-inventory/applications)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| extend Azure_Inventory=location\\r\\n| extend M365_Inventory=strcat(\\\"https://security.microsoft.com/machines\\\")\\r\\n| project AssetID=id,AssetType=type, Azure_Inventory, M365_Inventory\\r\\n| sort by AssetID asc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Inventory\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Azure_Inventory\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Azure Inventory >>\",\"bladeOpenContext\":{\"bladeName\":\"InventoryBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"\",\"source\":\"static\",\"value\":\"25\"}]}}},{\"columnMatch\":\"DefenderXDR_Inventory\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"DefenderXDR Inventory >>\"}}],\"rowLimit\":2500,\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"microsoft\\\"\\r\\n| project id,type,resourceGroup, tags\\r\\n| extend tag = strcat(tags)\\r\\n| summarize count() by tag\\r\\n| where tag <> \\\"\\\" \\r\\n| where tag <> \\\"{}\\\" \\r\\n| sort by count_ desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Tags Currently In Use\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"properties_storageProfile_osDisk_osType\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Windows\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Linux\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"green\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"🟦 Tags Currently In Use\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isAM1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Only Approved Services (AM-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-2-use-only-approved-services)\\r\\n\\r\\nEnsure that only approved cloud services can be used, by auditing and restricting which services users can provision in the environment. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Configure and Manage Azure Policy](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n💡 [How to Deny a Specific Resource Type with Azure Policy](https://docs.microsoft.com/azure/governance/policy/samples/index)
\\r\\n💡 [How to Create Queries with Azure Resource Graph Explorer](https://docs.microsoft.com/azure/governance/resource-graph/first-query-portal)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"AM.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| summarize count() by type\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Count by Type\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Subscription}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Security of Asset Lifecycle Management (AM-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-3-ensure-security-of-asset-lifecycle-management)\\r\\n\\r\\nEnsure security attributes or configurations of the assets are always updated during the asset lifecycle. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Delete Azure Resource Group and Resource](https://docs.microsoft.com/azure/azure-resource-manager/management/delete-resource-group)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationName contains \\\"delete\\\" or OperationName contains \\\"remove\\\" or OperationName contains \\\"update\\\" or OperationName contains \\\"create\\\"\\r\\n| summarize count() by OperationName, Caller\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Activity by User/Account\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isAM3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Limit Access to Asset Management (AM-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-4-limit-access-to-asset-management)\\r\\n\\r\\nLimit users' access to asset management features, to avoid accidental or malicious modification of the assets in your cloud. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Conditional Access to Block Access to Azure Resources Manager](https://docs.microsoft.com/azure/role-based-access-control/conditional-access-azure-management)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = SigninLogs\\r\\n| where ResultType == 0\\r\\n| where ResourceDisplayName contains \\\"Manage\\\" or ResourceDisplayName contains \\\"graph\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastObservedAccess=TimeGenerated;\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| where ResourceDisplayName contains \\\"Manage\\\" or ResourceDisplayName contains \\\"graph\\\"\\r\\n| summarize count() by UserPrincipalName, ResourceDisplayName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, ResourceDisplayName, UserProfile, LastObservedAccess, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Management Function Access\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Only Approved Apps in Virtual Machine (AM-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-5-use-only-approved-applications-in-virtual-machine)\\r\\n\\r\\nEnsure that only authorized software executes by creating an allow list and block the unauthorized software from executing in your environment.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Use Microsoft Defender for Cloud Adaptive Application Controls](https://docs.microsoft.com/azure/security-center/security-center-adaptive-application)
\\r\\n💡 [Understand Azure Automation Change Tracking and Inventory](https://docs.microsoft.com/azure/automation/change-tracking/overview)
\\r\\n💡 [How to Control PowerShell Script Execution in Windows Environments](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"AM.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-5\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Asset Management Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Logging & Threat Detection (LT)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection) \\r\\n---\\r\\nLogging and Threat Detection covers controls for detecting threats on Azure and enabling, collecting, and storing audit logs for Azure services, including enabling detection, investigation, and remediation processes with controls to generate high-quality alerts with native threat detection in Azure services; it also includes collecting logs with Azure Monitor, centralizing security analysis with Microsoft Sentinel, time synchronization, and log retention.\"},\"customWidth\":\"40\",\"name\":\"LT Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Threat Detection Capabilities (LT-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Threat Detection for Identity & Access Management (LT-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Logging for Security Investigation (LT-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Limit Access to Asset Management (LT-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"61226164-0f22-4271-bd57-aebde7d72af1\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1e93ea31-59fd-41fd-9f44-1ea9447c6779\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"c92c1ebd-90ac-466d-81b6-0b4a7e5e4cab\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Centralize Security Log Management & Analysis (LT-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Configure Log Storage Retention (LT-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Approved Time Synchronization Sources (LT-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6ee1efad-6ae5-4c5b-9ecf-29c52d5999e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"5bc1802f-413f-426c-b292-074f215308e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"11afdb83-5ddc-446a-832f-91dc11c06125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Threat Detection Capabilities (LT-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-1-enable-threat-detection-capabilities)\\r\\n\\r\\nTo support threat detection scenarios, monitor all known resource types for known and expected threats and anomalies. Configure your alert filtering and analytics rules to extract high-quality alerts from log data, agents, or other data sources to reduce false positives.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Identity]( https://www.microsoft.com/microsoft-365/security/identity-defender)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Threat Protection in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/azure-defender)
\\r\\n💡 [Microsoft Defender for Cloud Security Alerts Reference Guide](https://docs.microsoft.com/azure/security-center/alerts-reference)
\\r\\n💡 [Create Custom Analytics Rules to Detect Threats](https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom)
\\r\\n💡 [Cyber Threat Intelligence with Microsoft Sentinel](https://docs.microsoft.com/azure/architecture/example-scenario/data/sentinel-threat-intelligence)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\\r\\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\\r\\n🔀 [Microsoft Defender for IoT](https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started)
\\r\\n🔀 [Microsoft Defender for Identity](https://security.microsoft.com/settings/identities)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SecurityProducts = datatable(ProviderName:string, Product:string, Portal:string)\\r\\n[\\r\\n \\\"ASI Scheduled Alerts\\\", \\\"Microsoft Sentinel\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"MCAS\\\", \\\"Microsoft Defender for Cloud Apps\\\", \\\"https://portal.cloudappsecurity.com/\\\",\\r\\n \\\"MDATP\\\", \\\"Microsoft Defender for Endpoint\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"Azure Security Center\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"Detection-WarmPathV2\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"MicrosoftThreatProtection\\\", \\\"Microsoft 365 Defender\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"IPC\\\", \\\"Azure Active Directory Identity Protection\\\", \\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/Overview\\\",\\r\\n \\\"Detection-Fusion\\\", \\\"Machine Learning Fusion Alert\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"Sentinel Fusion\\\", \\\"Machine Learning Fusion Alert\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"Azure Advanced Threat Protection\\\", \\\"Microsoft Defender for Identity\\\", \\\"https://security.microsoft.com/settings/identities\\\",\\r\\n \\\"Threat Intelligence Alerts\\\", \\\"Threat Intelligence\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"IoTSecurity\\\", \\\"Microsoft Defender for IoT\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started\\\",\\r\\n \\\"MSTIC\\\", \\\"Microsoft Intelligent Security Graph\\\", \\\"https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade\\\",\\r\\n \\\"AntimalwarePublisher\\\", \\\"Microsoft Anti-Malware\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"OATP\\\", \\\"Microsoft Defender for Office 365\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"AdaptiveNetworkHardenings\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"StorageThreatDetection\\\", \\\"Azure Defender for Storage\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"CloudNetworkSecurity\\\", \\\"Azure Network Security\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview\\\",\\r\\n \\\"SQLThreatDetection\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\"\\r\\n];\\r\\nSecurityAlert\\r\\n| join kind=inner SecurityProducts on ProviderName\\r\\n| summarize count() by Product, Portal\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Alerts Count by Product\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Product\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Defense Evasion\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Portal\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Portal >>\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProductName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"UPN\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Incident >\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"city_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"state_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Threat Detection for Identity & Access Management (LT-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-2-enable-threat-detection-for--identity-and-access-management)\\r\\n\\r\\nDetect threats for identities and access management by monitoring the user and application sign-in and access anomalies. Behavioral patterns such as excessive number of failed login attempts, and deprecated accounts in the subscription, should be alerted.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) \\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Audit activity reports in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs)
\\r\\n💡 [Enable Azure Identity Protection](https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection)
\\r\\n💡 [Threat Protection in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/azure-defender)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AnomalousSigninActivity = BehaviorAnalytics\\r\\n | where ActionType == \\\"Sign-in\\\"\\r\\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\\r\\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\\r\\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\\r\\n | join (\\r\\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \\\"none\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Successful Logon\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indicaiton from AAD\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\\r\\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//witdstomstl\\r\\nlet AnomalousRoleAssignment = AuditLogs\\r\\n | where TimeGenerated > ago(28d)\\r\\n | where OperationName == \\\"Add member to role\\\"\\r\\n | mv-expand TargetResources\\r\\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\\r\\n | where isnotempty(RoleId) and RoleId in (critical, high)\\r\\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\\r\\n | where isnotempty(RoleName)\\r\\n | extend TargetId = tostring(TargetResources.id)\\r\\n | extend Target = tostring(TargetResources.userPrincipalName)\\r\\n | join kind=inner (\\r\\n BehaviorAnalytics\\r\\n | where ActionType == \\\"Add member to role\\\"\\r\\n | where UsersInsights.BlasrRadius == \\\"High\\\" or ActivityInsights.FirstTimeUserPerformedAction == true\\r\\n )\\r\\n on $left._ItemId == $right.SourceRecordId\\r\\n | extend AnomalyName = \\\"Anomalous Role Assignemt\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Account Manipulation\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to priveleged role, or ones that add users for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, RoleName, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; let LogOns=materialize(\\r\\n BehaviorAnalytics\\r\\n | where ActivityType == \\\"LogOn\\\");\\r\\nlet AnomalousResourceAccess = LogOns\\r\\n | where ActionType == \\\"ResourceAccess\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | extend AnomalyName = \\\"Anomalous Resource Access\\\",\\r\\n Tactic = \\\"Lateral Movement\\\",\\r\\n Technique = \\\"\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousRDPActivity = LogOns\\r\\n | where ActionType == \\\"RemoteInteractiveLogon\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | extend AnomalyName = \\\"Anomalous RDP Activity\\\",\\r\\n Tactic = \\\"Lateral Movement\\\",\\r\\n Technique = \\\"\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousLogintoDevices = LogOns\\r\\n | where ActionType == \\\"InteractiveLogon\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\\r\\n | extend AnomalyName = \\\"Anomalous Login To Devices\\\",\\r\\n Tactic = \\\"Privilege Escalation\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administator users performing an interactive logon (4624:2) to a device for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousPasswordReset = BehaviorAnalytics\\r\\n | where ActionType == \\\"Reset user password\\\"\\r\\n | where ActivityInsights.FirstTimeUserPerformedAction == \\\"True\\\"\\r\\n | join (\\r\\n AuditLogs\\r\\n | where OperationName == \\\"Reset user password\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | mv-expand TargetResources\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Password Reset\\\",\\r\\n Tactic = \\\"Impact\\\",\\r\\n Technique = \\\"Account Access Removal\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority\\r\\n | sort by TimeGenerated desc;\\r\\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\\r\\n | where ActionType == \\\"Sign-in\\\"\\r\\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\\r\\n | join (\\r\\n SigninLogs\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Successful Logon\\\",\\r\\n Tactic = \\\"Initial Access\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousFailedLogon = BehaviorAnalytics\\r\\n | where ActivityType == \\\"LogOn\\\"\\r\\n | where UsersInsights.BlastRadius == \\\"High\\\"\\r\\n | join (\\r\\n SigninLogs \\r\\n | where Status.errorCode == 50126\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Failed Logon\\\",\\r\\n Tactic = \\\"Credential Access\\\",\\r\\n Technique = \\\"Brute Force\\\",\\r\\n SubTechnique = \\\"Password Guessing\\\",\\r\\n Description = \\\"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousAADAccountManipulation = AuditLogs\\r\\n | where OperationName == \\\"Update user\\\"\\r\\n | mv-expand AdditionalDetails\\r\\n | where AdditionalDetails.key == \\\"UserPrincipalName\\\"\\r\\n | mv-expand TargetResources\\r\\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\\r\\n | where isnotempty(RoleId) and RoleId in (critical, high)\\r\\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\\r\\n | where isnotempty(RoleName)\\r\\n | extend TargetId = tostring(TargetResources.id)\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | join kind=inner ( \\r\\n BehaviorAnalytics\\r\\n | where ActionType == \\\"Update user\\\"\\r\\n | where UsersInsights.BlasrRadius == \\\"High\\\" or ActivityInsights.FirstTimeUserPerformedAction == true\\r\\n )\\r\\n on $left._ItemId == $right.SourceRecordId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName) \\r\\n | extend AnomalyName = \\\"Anomalous Account Manipulation\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Account Manipulation\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to priveleged role, or ones that changed users for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, RoleName, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\\r\\n | where ActionType == \\\"Add user\\\"\\r\\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\\r\\n | join(\\r\\n AuditLogs\\r\\n | where OperationName == \\\"Add user\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | mv-expand TargetResources\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\\r\\n UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Account Creation\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Create Account\\\",\\r\\n SubTechnique = \\\"Cloud Account\\\",\\r\\n Description = \\\"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\\\"\\t\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority\\r\\n | sort by TimeGenerated desc;\\r\\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\\r\\nlet TopUsersByAnomalies = AnomalyTable\\r\\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\\r\\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\\r\\n | sort by AnomalyCount desc;\\r\\nlet TopUsersByIncidents = SecurityIncident\\r\\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\\r\\n | where Status == \\\"New\\\" or Status == \\\"Active\\\"\\r\\n | mv-expand AlertIds\\r\\n | extend AlertId = tostring(AlertIds)\\r\\n | join kind= innerunique ( \\r\\n SecurityAlert \\r\\n )\\r\\n on $left.AlertId == $right.SystemAlertId\\r\\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\\r\\n | mv-expand todynamic(Entities)\\r\\n | where Entities[\\\"Type\\\"] =~ \\\"account\\\"\\r\\n | extend Name = tostring(tolower(Entities[\\\"Name\\\"])), NTDomain = tostring(Entities[\\\"NTDomain\\\"]), UPNSuffix = tostring(Entities[\\\"UPNSuffix\\\"]), AadUserId = tostring(Entities[\\\"AadUserId\\\"]), AadTenantId = tostring(Entities[\\\"AadTenantId\\\"]), \\r\\n Sid = tostring(Entities[\\\"Sid\\\"]), IsDomainJoined = tobool(Entities[\\\"IsDomainJoined\\\"]), Host = tostring(Entities[\\\"Host\\\"])\\r\\n | extend UPN = iff(Name != \\\"\\\" and UPNSuffix != \\\"\\\", strcat(Name, \\\"@\\\", UPNSuffix), \\\"\\\")\\r\\n | union TopUsersByAnomalies\\r\\n | extend \\r\\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\\r\\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\\r\\n UPNExists = iff(isempty(UPN), false, true),\\r\\n NameExists = iff(isempty(Name), false, true),\\r\\n SidExists = iff(isempty(Sid), false, true),\\r\\n AADExists = iff(isempty(AadUserId), false, true)\\r\\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\\r\\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\\r\\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\\r\\n | project [\\\"UserName\\\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\\\"AadUserId\\\"]=AadAnchor, [\\\"OnPremSid\\\"]=SidAnchor, [\\\"UserPrincipalName\\\"]=UPNAnchor;\\r\\nTopUsersByIncidents\\r\\n| where UserPrincipalName <> \\\"\\\"\\r\\n| where UserPrincipalName !contains \\\"[\\\"\\r\\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\\r\\n| sort by AlertCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" User Entity Behavior Analytics (UEBA)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"AlertCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}},{\"columnMatch\":\"AnomalyCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellow\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_heatmap_AlertCount_2\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_heatmap_AlertCount_2\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityAlert\\r\\n| where ProviderName == \\\"IPC\\\"\\r\\n| extend UserAccount = tostring(parse_json(ExtendedProperties).[\\\"User Account\\\"])\\r\\n| summarize count() by AlertName, AlertLink, ProductName, UserAccount\\r\\n| extend Count = count_\\r\\n| project AlertName, Count\\r\\n| sort by Count desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Entra ID Identity Protection: Security Alerts \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Logging for Security Investigation (LT-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation)\\r\\n\\r\\nEnable logging for your cloud resources to meet the requirements for security incident investigations and security response and compliance purposes.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Logging and Different Log Types in Azure](https://docs.microsoft.com/azure/azure-monitor/essentials/platform-logs-overview)
\\r\\n💡 [Understand Microsoft Defender for Cloud Data Collection](https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection)
\\r\\n💡 [Enable and configure antimalware monitoring](https://docs.microsoft.com/azure/security/fundamentals/antimalware#enable-and-configure-antimalware-monitoring-using-powershell-cmdlets)
\\r\\n💡 [Operating systems and application logs inside in your compute resources](https://learn.microsoft.com/en-us/azure/azure-monitor/data-sources#operating-system-guest)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource = Table_Name *\\r\\n| summarize count() by Table_Name\\r\\n| project-rename Log_Tables=Table_Name, Logs_Count=count_\\r\\n| sort by Logs_Count desc\\r\\n| limit 100\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Logs Count by Data Table\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Log_Tables\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Logs_Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Network Logging for Security Investigation (LT-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-4-enable-network-logging-for-security-investigation)\\r\\n\\r\\nEnable logging for your network services to support network-related incident investigations, threat hunting, and security alert generation. The network logs may include logs from network services such as IP filtering, network and application firewall, DNS, flow monitoring and so on. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/) ✳️ [Application Gateway]( https://azure.microsoft.com/services/application-gateway/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable Network Security Group Flow Logs](https://docs.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-portal)
\\r\\n💡 [Azure Firewall Logs and Metrics](https://docs.microsoft.com/azure/firewall/logs-and-metrics)
\\r\\n💡 [Azure Networking Monitoring Solutions in Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/insights/azure-networking-analytics)
\\r\\n💡 [Gather Insights About Your DNS Infrastructure With the DNS Analytics Solution](https://docs.microsoft.com/azure/azure-monitor/insights/dns-analytics)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Azure Web Application Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies)
\\r\\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"microsoft.network\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Networking Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where OperationName == \\\"NetworkSecurityGroupEvents\\\"\\r\\n| summarize count() by ruleName_s\\r\\n| sort by count_ desc \\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Security Groups: Rules Triggered\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where OperationName == \\\"NetworkSecurityGroupEvents\\\"\\r\\n| summarize count() by ruleName_s\\r\\n| project NetworkSecurityGroupRule=ruleName_s, FlowCount=count_\\r\\n| sort by FlowCount desc \",\"size\":0,\"showAnalytics\":true,\"title\":\"Flow Counts\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"NetworkSecurityGroupRule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Lateral_Movement\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"FlowCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Centralize Security Log Management & Analysis (LT-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-5-centralize-security-log-management-and-analysis)\\r\\n\\r\\nCentralize logging storage and analysis to enable correlation across log data. For each log source, ensure that you have assigned a data owner, access guidance, storage location, what tools are used to process and access the data, and data retention requirements. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Collect Platform Logs and Metrics with Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings)
\\r\\n💡 [How to Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource=_TableName *\\r\\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\\\"second\\\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by _TableName, _IsBillable\\r\\n| project ['Table Name'] = _TableName, ['Table Size'] = Size, ['Table Entries'] = Entries,\\r\\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable\\r\\n| order by ['Table Size'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Log Table Management\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Table Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Table Size\",\"formatter\":8,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Entries\",\"formatter\":8,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Size per Entry\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"IsBillable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"True\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"False\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Important\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_IsBillable_4\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_IsBillable_4\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DataType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource=_TableName *\\r\\n| summarize count() , Size = sum(_BilledSize) by bin(_TimeReceived, 1m), Type, _IsBillable\\r\\n| extend counttemp =count_ / 60\\r\\n| summarize \\r\\n ['Current EPS Average']=avg(counttemp), ['Minimum EPS']=min(counttemp),\\r\\n ['Maximum EPS']=max(counttemp)\\r\\n by ['Table Name']=Type\\r\\n| order by ['Current EPS Average'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Log Table Events Per Second (EPS) Management\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Table Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current EPS Average\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},{\"columnMatch\":\"Minimum EPS\",\"formatter\":3,\"formatOptions\":{\"palette\":\"red\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},{\"columnMatch\":\"Maximum EPS\",\"formatter\":3,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Size\",\"formatter\":8,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Entries\",\"formatter\":8,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Size per Entry\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"IsBillable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"True\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"False\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Important\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Current EPS Average_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Current EPS Average_1\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DataType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Configure Log Storage Retention (LT-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-6-configure-log-storage-retention)\\r\\n\\r\\nPlan your log retention strategy according to your compliance, regulation, and business requirements. Configure the log retention policy at the individual logging services to ensure the logs are archived appropriately.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Change the Data Retention Period in Log Analytics](https://docs.microsoft.com/azure/azure-monitor/logs/manage-cost-storage#change-the-data-retention-period)
\\r\\n💡 [How to Configure Retention Policy for Azure Storage Account Logs](https://docs.microsoft.com/azure/storage/common/manage-storage-analytics-logs#configure-logging)
\\r\\n💡 [Microsoft Defender for Cloud Alerts and Recommendations Export](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces' \\r\\n| extend state = trim(' ', tostring(properties.provisioningState))\\r\\n\\t\\t,sku = trim(' ', tostring(properties.sku.name))\\r\\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\\r\\n\\t\\t,retentionDays = trim(' ', tostring(properties.retentionInDays))\\r\\n\\t\\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\\r\\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\\\"Not set\\\")\\r\\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\\\"Unknown\\\")\\r\\n| extend sentinel = iif(toint(retentionDays) < 90,\\\"If you have Sentinel, you can change your retention to 90days (free)?\\\",\\\"\\\")\\r\\n| project ['Workspace Name']=id, ['Data Retention(days)']=retentionDays, ['Daily Data Cap']=dailyquotaGB, ['Resource Group']=resourceGroup, location, ['License']=sku\",\"size\":2,\"showAnalytics\":true,\"title\":\" Log Retention Configurations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Computer\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_link_Workspace Name_0\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_link_Workspace Name_0\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Approved Time Synchronization Sources (LT-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-7-use-approved-time-synchronization-sources)\\r\\n\\r\\nUse approved time synchronization sources for your logging time stamp which include date, time and time zone information.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [_Im_NetworkSession](https://docs.microsoft.com/azure/sentinel/network-normalization-schema) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Time Synchronization for Azure Windows Compute Resources](https://docs.microsoft.com/azure/virtual-machines/windows/time-sync)
\\r\\n💡 [How to Configure Time Synchronization for Azure Linux Compute Resources](https://docs.microsoft.com/azure/virtual-machines/linux/time-sync)
\\r\\n💡 [How to Disable Inbound UDP for Azure Services](https://support.microsoft.com/help/4558520/how-to-disable-inbound-udp-for-azure-services)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID Domain Services](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.AAD%2FdomainServices)
\\r\\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\\r\\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_NetworkSession\\r\\n| where NetworkProtocol == \\\"UDP\\\"\\r\\n| where NetworkDirection == \\\"outbound\\\"\\r\\n| where DstPortNumber == \\\"123\\\"\\r\\n| summarize count() by DstIpAddr\\r\\n| sort by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Time Protocol Calls by Destination IP\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Logging & Threat Detection Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Incident Response (IR)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)\\r\\n---\\r\\nIncident Response covers controls in incident response life cycle - preparation, detection and analysis, containment, and post-incident activities, including using Azure services such as Microsoft Defender for Cloud and Sentinel to automate the incident response process. \"},\"customWidth\":\"40\",\"name\":\"IR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Update Incident Response Plan (IR-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Setup Incident Notification (IR-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Create Incidents Based in Alerts (IR-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Investigate an Incident (IR-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"fe9f6742-6af1-4434-9bbc-3aa855136070\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"8f0c3fdc-2da1-482b-962f-8b81f2edc636\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"b16aea45-a93f-4278-add1-33a0d763920d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Prioritize Incidents (IR-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Automate Incident Handling (IR-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Lessons Learned & Retain Evidence (IR-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6ee1efad-6ae5-4c5b-9ecf-29c52d5999e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"5bc1802f-413f-426c-b292-074f215308e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"11afdb83-5ddc-446a-832f-91dc11c06125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Preparation - Update Incident Response Plan & Handling Process (IR-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-1-preparation---update-incident-response-plan-and-handling-process)\\r\\n\\r\\nEnsure your organization follows industry best practice to develop processes and plans to respond to security incidents on the cloud platforms. Be mindful about the shared responsibility model and the variances across IaaS, PaaS and SaaS services. This will have a direct impact to how you collaborate with your cloud provider in incident response and handling activities, such as incident notification and triage, evidence collection, investigation, eradication and recovery.\\r\\n\\r\\n## Implementation\\r\\n💡 [Implement Security Across the Enterprise Environment](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\\r\\n💡 [Incident Response Reference Guide](https://docs.microsoft.com/microsoft-365/downloads/IR-Reference-Guide.pdf)
\\r\\n💡 [NIST SP 800-61 Computer Security Incident Handling Guide](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"name\":\"IR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Building Your Own Security Incident Response Process](https://msrc-blog.microsoft.com/2019/07/01/inside-the-msrc-building-your-own-security-incident-response-process/) \\r\\n![Image Name](https://msrc.microsoft.com/blog/2019/07/inside-the-msrc-building-your-own-security-incident-response-process/wp-content-uploads-2019-07-SSIRP-best-practices-headers_hu72b36f1b90d60f19ba86700a50132f62_74722_800x0_resize_q75_box.jpg)\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Preparation - Setup Incident Notification (IR-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-2-preparation---setup-incident-notification)\\r\\n\\r\\nEnsure the security alerts and incident notification from the cloud service provider's platform and your environments can be received by correct contact in your incident response organization.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Set the Microsoft Defender for Cloud Security Contact](https://docs.microsoft.com/azure/security-center/security-center-provide-security-contact-details)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Logic Apps](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IR.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type == \\\"microsoft.logic/workflows\\\"\\r\\n| extend Connection = parse_json(properties)[\\\"parameters\\\"][\\\"$connections\\\"][\\\"value\\\"]\\r\\n| where Connection has \\\"managedApis/azuresentinel\\\"\\r\\n| where id contains \\\"push\\\" or id contains \\\"send\\\" or id contains \\\"message\\\" or id contains \\\"text\\\" or id contains \\\"email\\\" or id contains \\\"notif\\\" or id contains \\\"team\\\" or id contains \\\"post\\\"\\r\\n| project id, type, resourceGroup\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Notification Playbooks Configured\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue startswith \\\"Microsoft.Logic\\\"\\r\\n| where ActivityStatusValue == \\\"Success\\\" or ActivityStatusValue == \\\"Succeeded\\\"\\r\\n| extend scope_ = tostring(Authorization_d.scope)\\r\\n| parse-where scope_ with * 'workflows/' PlaybookName '/' *\\r\\n| where PlaybookName contains \\\"notify\\\" or PlaybookName contains \\\"email\\\" or PlaybookName contains \\\"teams\\\" or PlaybookName contains \\\"ticket\\\" or PlaybookName contains \\\"post\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by PlaybookName\\r\\n| render timechart \",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Notification Playbooks Triggered over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isIR2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Create Incidents Based on High-Quality Alerts (IR-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-3-detection-and-analysis---create-incidents-based-on-high-quality-alerts)\\r\\n\\r\\nEnsure you have a process to create high-quality alerts and measure the quality of alerts. This allows you to learn lessons from past incidents and prioritize alerts for analysts, so they don't waste time on false positives.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Export](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n💡 [How to Stream Alerts Into Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-security-center)
\\r\\n💡 [Understand Security Coverage by the MITRE ATT&CK® Framework](https://docs.microsoft.com/azure/sentinel/mitre-coverage)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IR.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"name\":\"query - 3\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"521d368e-c46e-41b5-bea0-fd07dc96b511\",\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Review Current MITRE Coverage >>\",\"style\":\"secondary\",\"bladeOpenContext\":{\"bladeName\":\"MitrePage.ReactView\",\"extensionName\":\"Microsoft_Azure_Security_Insights\"}}]},\"name\":\"links - 8\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Investigate an Incident (IR-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-4-detection-and-analysis---investigate-an-incident)\\r\\n\\r\\nEnsure security operation team can query and use diverse data sources as they investigate potential incidents, to build a full view of what happened. Diverse logs should be collected to track the activities of a potential attacker across the kill chain to avoid blind spots. You should also ensure insights and learnings are captured for other analysts and for future historical reference.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Snapshot a Windows Machine's Disk](https://docs.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk)
\\r\\n💡 [Snapshot a Linux Machine's Disk](https://docs.microsoft.com/azure/virtual-machines/linux/snapshot-copy-managed-disk)
\\r\\n💡 [Microsoft Azure Support Diagnostic Information and Memory Dump Collection](https://azure.microsoft.com/support/legal/support-diagnostic-information-collection/)
\\r\\n💡 [Investigate Incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident \\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| where Severity == \\\"High\\\"\\r\\n| summarize count() by [\\\"Incident Name\\\"]=Title\\r\\n| sort by count_ desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"High Severity Incident Types\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident \\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| extend [\\\"MITRE ATT&CK® Tactics\\\"] = tostring(parse_json(tostring(AdditionalData.tactics))[0])\\r\\n| where [\\\"MITRE ATT&CK® Tactics\\\"] <> \\\"\\\"\\r\\n| summarize count() by [\\\"MITRE ATT&CK® Tactics\\\"]\\r\\n| sort by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"MITRE ATT&CK®Tactics Observed\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"InitialAccess\",\"color\":\"orange\"},{\"seriesName\":\"Exfiltration\",\"color\":\"orange\"},{\"seriesName\":\"Execution\",\"color\":\"orange\"},{\"seriesName\":\"PrivilegeEscalation\",\"color\":\"orange\"},{\"seriesName\":\"Persistence\",\"color\":\"orange\"},{\"seriesName\":\"DefenseEvasion\",\"color\":\"orange\"},{\"seriesName\":\"CredentialAccess\",\"color\":\"orange\"},{\"seriesName\":\"Discovery\",\"color\":\"orange\"},{\"seriesName\":\"Collection\",\"color\":\"orange\"},{\"seriesName\":\"Impact\",\"color\":\"orange\"},{\"seriesName\":\"Other\",\"color\":\"orange\"}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Investigate Incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases) \\r\\n![Image Name](https://docs.microsoft.com/azure/sentinel/media/tutorial-investigate-cases/investigation-map.png)\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Prioritize Incidents (IR-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-5-detection-and-analysis---prioritize-incidents)\\r\\n\\r\\nProvide context to security operations teams to help them determine which incidents ought to first be focused on, based on alert severity and asset sensitivity defined in your organization’s incident response plan. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Security Alerts in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-alerts-overview)
\\r\\n💡 [Use Tags to Organize Your Azure Resources](https://docs.microsoft.com/azure/azure-resource-manager/management/tag-resources)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) \"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| where Status <> \\\"Closed\\\"\\r\\n| summarize count() by Severity\\r\\n| render barchart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Open Incidents by Priority\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Informational\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Open Incidents by Priority\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Severity\\r\\n| render timechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Security Incident Severity Count over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Informational\",\"color\":\"gray\"}]}},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"🟦 Security Incident Priorities over Time\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Containment, Eradication & Recovery - Automate Incident Handling (IR-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-6-containment-eradication-and-recovery---automate-the-incident-handling)\\r\\n\\r\\nAutomate the manual, repetitive tasks to speed up response time and reduce the burden on analysts. Manual tasks take longer to execute, slowing each incident and reducing how many incidents an analyst can handle. Manual tasks also increase analyst fatigue, which increases the risk of human error that causes delays and degrades the ability of analysts to focus effectively on complex tasks. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Configure Workflow Automation in Security Center](https://docs.microsoft.com/azure/security-center/workflow-automation)
\\r\\n💡 [Setup Automated Threat Responses in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/tutorial-security-incident#triage-security-alerts)
\\r\\n💡 [Setup Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Logic Apps](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type == \\\"microsoft.logic/workflows\\\"\\r\\n| extend Connection = parse_json(properties)[\\\"parameters\\\"][\\\"$connections\\\"][\\\"value\\\"]\\r\\n| where Connection has \\\"managedApis/azuresentinel\\\"\\r\\n| project id, type, resourceGroup\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Playbooks Configured\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue startswith \\\"Microsoft.Logic\\\"\\r\\n| where ActivityStatusValue == \\\"Success\\\" or ActivityStatusValue == \\\"Succeeded\\\"\\r\\n| extend scope_ = tostring(Authorization_d.scope)\\r\\n| parse-where scope_ with * 'workflows/' PlaybookName '/' *\\r\\n| where PlaybookName contains \\\"notify\\\" or PlaybookName contains \\\"email\\\" or PlaybookName contains \\\"teams\\\" or PlaybookName contains \\\"ticket\\\" or PlaybookName contains \\\"post\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by PlaybookName\\r\\n| render timechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Playbooks Triggered over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Resource\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Post-Incident Activity - Conduct Lessons Learned & Retain Evidence (IR-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-7-post-incident-activity---conduct-lesson-learned-and-retain-evidence)\\r\\n\\r\\nConduct lesson learned in your organization periodically and/or after major incidents, to improve your future capability in incident response and handling. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Incident Response Process - Post-Incident Cleanup](https://docs.microsoft.com/security/compass/incident-response-process#2-post-incident-cleanup)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Incident Response/Resolution Times\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\n| extend Tactics = todynamic(AdditionalData.tactics)\\n| extend Owner = todynamic(Owner.assignedTo) \\n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \\n| extend TimeToTriage = (FirstModifiedTime - CreatedTime)/1h\\n| where TimeToTriage <> 0\\n| summarize 50th_Percentile=percentile(TimeToTriage, 50) \\n\",\"size\":1,\"showAnalytics\":true,\"title\":\"Mean Time To Respond\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"50th_Percentile\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\n| where Status == \\\"Closed\\\"\\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\\n| extend Tactics = todynamic(AdditionalData.tactics)\\n| extend Owner = todynamic(Owner.assignedTo) \\n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\\n| where TimeToClosure <> 0\\n| summarize 50th_Percentile=percentile(TimeToClosure, 50)\",\"size\":1,\"showAnalytics\":true,\"title\":\"Mean Time To Resolve\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Classification\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"50th_Percentile\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"customWidth\":\"50\",\"name\":\"Incident Response/Resolution Times\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber\\r\\n| where Status == \\\"Closed\\\"\\r\\n| extend TimeToRespond = (CreatedTime - FirstActivityTime)/1d \\r\\n| extend TimeToResolve = (ClosedTime - CreatedTime)/1d\\r\\n| extend AssignedAnalyst = tostring(Owner.assignedTo)\\r\\n| extend [\\\"MITRE ATT&CK Tactics\\\"] = tostring(parse_json(tostring(AdditionalData.tactics))[0])\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, ClosedTime desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, [\\\"MITRE ATT&CK Tactics\\\"], AssignedAnalyst, Classification, ClassificationComment, ClassificationReason, Description, TimeToRespond, TimeToResolve, IncidentStartTime=CreatedTime, IncidentClosedTime=ClosedTime, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Incident Closure Reports\",\"noDataMessage\":\"No Incidents Observed Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Go to Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"TimeToRespond\",\"formatter\":0,\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"TimeToResolve\",\"formatter\":0,\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Incident Response Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Posture & Vulnerability Management (PV)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)\\r\\n---\\r\\nPosture and Vulnerability Management focuses on controls for assessing and improving Azure security posture, including vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting, and correction in Azure resources. \"},\"customWidth\":\"40\",\"name\":\"PV Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Establish Secure Configurations (PV-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Audit & Enforce Secure Configurations (PV-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Establish Secure Configurations for Compute Resources (PV-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Audit & Enforce Secure Configurations for Compute Resources (PV-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"88da2310-858d-4451-a58a-ce067a466f15\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e00258ef-49b5-4ac0-82d2-c67148d616d9\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9dfe4f44-10f2-4eb2-a98c-abd4a36b69a8\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Perform Vulnerability Assessments (PV-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Rapidly & Automatically Remediate Vulnerabilities (PV-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Regular Red Team Operations (PV-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c12c9953-b31b-4d5d-b39d-8142caaa046b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"69a28041-108a-4881-bd8d-aabaa851fab6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7eec1f60-b3eb-45ea-81f5-64feb69dfb96\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Establish Secure Configurations (PV-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-1-define-and-establish-secure-configurations)\\r\\n\\r\\nDefine the secure configuration baselines for different resource types in the cloud. Alternatively, use configuration management tools to establish the configuration baseline automatically before or during resource deployment so the environment can be compliant by default after the deployment.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Illustration of Guardrails Implementation in Enterprise-Scale Landing Zone](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture#landing-zone-expanded-definition)
\\r\\n💡 [Working with Security Policies in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/tutorial-security-policy)
\\r\\n💡 [Tutorial: Create and manage policies to enforce compliance](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\\r\\n🔀 [Microsoft Defender for Cloud: Regulatory Compliance](https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| summarize count() by ComplianceStandard\\r\\n| sort by count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Regulatory Compliance Assessments by Standard Policy Checks\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Audit & Enforce Secure Configurations (PV-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-2-audit-and-enforce-secure-configurations)\\r\\n\\r\\nContinuously monitor and alert when there is a deviation from the defined configuration baseline. Enforce the desired configuration according to the baseline configuration by denying the non-compliant configuration or deploy a configuration. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Azure Policy Effects](https://docs.microsoft.com/azure/governance/policy/concepts/effects)
\\r\\n💡 [Create and Manage Policies to Enforce Compliance](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n💡 [Get compliance data of Azure resources](https://docs.microsoft.com/azure/governance/policy/how-to/get-compliance-data)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Establish Secure Configurations for Compute Resources (PV-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-3-define-and-establish-secure-configurations-for-compute-resources)\\r\\n\\r\\nDefine the secure configuration baselines for your compute resources, such as VMs and containers. Use configuration management tools to establish the configuration baseline automatically before or during the compute resource deployment so the environment can be compliant by default after the deployment. Alternatively, use a pre-configured image to build the desired configuration baseline into the compute resource image template. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\\r\\n💡 [Linux OS security configuration baseline](https://docs.microsoft.com/azure/governance/policy/samples/guest-configuration-baseline-linux)
\\r\\n💡 [Windows OS security configuration baseline](https://docs.microsoft.com/azure/governance/policy/samples/guest-configuration-baseline-windows)
\\r\\n💡 [Security configuration recommendation for compute resources](https://docs.microsoft.com/azure/security-center/recommendations-reference)
\\r\\n💡 [Azure Automation State Configuration Overview](https://docs.microsoft.com/azure/automation/automation-dsc-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FailedAssets=SecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| where AnalyzeResult == \\\"Failed\\\"\\r\\n| summarize FailedAssets = makelist(Computer) by Description;\\r\\nlet PassedAssets=SecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| where AnalyzeResult == \\\"Passed\\\"\\r\\n| summarize PassedAssets = makelist(Computer) by Description;\\r\\nSecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| summarize\\r\\n Failed = countif(AnalyzeResult == \\\"Failed\\\"),\\r\\n Passed = countif(AnalyzeResult == \\\"Passed\\\"),\\r\\n Total = countif(AnalyzeResult == \\\"Failed\\\" or AnalyzeResult == \\\"Passed\\\")\\r\\n by Description\\r\\n| extend PassedControls = (Passed / todouble(Total)) * 100\\r\\n| join kind=fullouter(FailedAssets) on Description\\r\\n| join kind=fullouter(PassedAssets) on Description\\r\\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Configure Security Baselines\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Description\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Audit & Enforce Secure Configurations for Compute Resources (PV-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-4-audit-and-enforce-secure-configurations-for-compute-resources)\\r\\n\\r\\nContinuously monitor and alert when there is a deviation from the defined configuration baseline in your compute resources. Enforce the desired configuration according to the baseline configuration by denying the non-compliant configuration or deploy a configuration in compute resources. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [How to Create an Azure Virtual Machine from an ARM Template](https://docs.microsoft.com/azure/virtual-machines/windows/ps-template)
\\r\\n💡 [Azure Automation State Configuration Overview](https://docs.microsoft.com/azure/automation/automation-dsc-overview)
\\r\\n💡 [Create a Windows Virtual Machine in the Azure portal](https://docs.microsoft.com/azure/virtual-machines/windows/quick-create-portal)
\\r\\n💡 [Container Security in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/container-security)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Perform Vulnerability Assessments (PV-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-5-perform-vulnerability-assessments)\\r\\n\\r\\nPerform vulnerabilities assessment for your cloud resources at all tiers in a fixed schedule or on-demand. Track and compare the scan results to verify the vulnerabilities are remediated. The assessment should include all type of vulnerabilities, such as vulnerabilities in Azure services, network, web, operating systems, misconfigurations, and so on.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) 🔷 [SecurityNestedRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [Integrated Vulnerability Scanner for Virtual Machines](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [SQL Vulnerability Assessment](https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment)
\\r\\n💡 [Exporting Microsoft Defender for Cloud Vulnerability Scan Results](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityNestedRecommendation\\r\\n| where RecommendationState == \\\"Unhealthy\\\"\\r\\n| summarize count() by RecommendationName, RecommendationSeverity\\r\\n| sort by count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Patches, Updates & Vulnerabilities\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Link_\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n| where type == \\\"microsoft.security/assessments/subassessments\\\"\\r\\n| extend assessmentKey = extract(\\\".*assessments/(.+?)/.*\\\",1, id)\\r\\n| where assessmentKey == \\\"1195afff-c881-495e-9bc5-1486211ae03f\\\"\\r\\n | project Resource = tolower(extract(\\\"([\\\\\\\\s\\\\\\\\S]*?)(/providers/Microsoft.Security.*)\\\",1,id)), ResourceGroup = trim_end(\\\"/\\\",extract(\\\".*resourceGroups/(.+?)/\\\",0,id)), ResourceType = tolower(split(id,\\\"/\\\").[6]), subscriptionId, severity = tostring(parse_json(properties).status.severity), status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), description = tostring(parse_json(properties).displayName), patchable = parse_json(properties.additionalData).patchable, cve = parse_json(properties.additionalData).cve\\r\\n | where status == 'Unhealthy'\\r\\n | summarize dcount(VulnId) by ResourceGroup, Resource, severity, VulnId, description, tostring(patchable), tostring(cve)\\r\\n | summarize Total = count(dcount_VulnId), sevH=countif(severity=='High'), sevM=countif(severity=='Medium'), sevL=countif(severity=='Low'), patchAvailable = countif(patchable=='true'), CVEcount =countif(cve!='[]') by ResourceGroup, Resource\\r\\n | order by sevH desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Vulnerability Scanning >> Select Asset for Details Below\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"exportFieldName\":\"Resource\",\"exportParameterName\":\"selectedServer\",\"exportDefaultValue\":\"All\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Subscription}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":13,\"formatOptions\":{\"linkColumn\":\"Resource\",\"linkTarget\":\"Resource\",\"showIcon\":true,\"customColumnWidthSetting\":\"30ch\"}},{\"columnMatch\":\"ResourceGroup\",\"formatter\":5},{\"columnMatch\":\"Resource\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"Total\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"10ch\"}},{\"columnMatch\":\"sevH\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"sevM\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellow\",\"customColumnWidthSetting\":\"13ch\"}},{\"columnMatch\":\"sevL\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"10ch\"}},{\"columnMatch\":\"patchAvailable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"pending\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"CVEcount\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"4\",\"text\":\"{0}{1}\"}],\"customColumnWidthSetting\":\"10ch\"}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ResourceGroup\"],\"expandTopLevel\":true,\"finalBy\":\"Resource\"},\"labelSettings\":[{\"columnId\":\"ResourceGroup\",\"label\":\"Resource group\"},{\"columnId\":\"sevH\",\"label\":\"High\"},{\"columnId\":\"sevM\",\"label\":\"Medium\"},{\"columnId\":\"sevL\",\"label\":\"Low\"},{\"columnId\":\"patchAvailable\",\"label\":\"Available patches\"},{\"columnId\":\"CVEcount\",\"label\":\"CVEs\"}]}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n| where type == \\\"microsoft.security/assessments/subassessments\\\"\\r\\n| extend assessmentKey = extract(\\\".*assessments/(.+?)/.*\\\",1, id)\\r\\n| where assessmentKey == \\\"1195afff-c881-495e-9bc5-1486211ae03f\\\"\\r\\n| project Resource = tolower(extract(\\\"([\\\\\\\\s\\\\\\\\S]*?)(/providers/Microsoft.Security.*)\\\",1,id)), ResourceGroup = trim_end(\\\"/\\\",extract(\\\".*resourceGroups/(.+?)/\\\",0,id)), ResourceType = tolower(split(id,\\\"/\\\").[6]), subscriptionId, Severity = tostring(parse_json(properties).status.severity), Status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), Description = tostring(parse_json(properties).displayName), Patchable = parse_json(properties.additionalData).patchable, CVE = properties.additionalData.cve, Category = tostring(properties.category), TimeGenerated = tostring(properties.timeGenerated), Remediation = tostring(properties.remediation), Impact = tostring(properties.impact), Threat = tostring(properties.additionalData.threat)\\r\\n| where Status == 'Unhealthy'\\r\\n| where '{selectedServer}' == 'All' or Resource == '{selectedServer}'\\r\\n| project Severity, VulnId, Description, tostring(Patchable), Category, Resource, ResourceGroup, CVE, TimeGenerated, Remediation, Impact, Threat\\r\\n| mv-expand CveExpand = split (CVE, \\\"},\\\") to typeof(string)\\r\\n| parse CveExpand with * '\\\"title\\\":\\\"' singleCve '\\\"' *\\r\\n| summarize CVEs = tostring(make_list(singleCve)) by Severity, VulnId, Description, tostring(Patchable), Category, Resource, ResourceGroup, TimeGenerated, Threat, Impact, Remediation\",\"size\":0,\"showAnalytics\":true,\"title\":\"Vulnerability Details >> Select Asset Above\",\"noDataMessage\":\"Select Asset in Vulnerability Scanning Panel Above\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":5},{\"columnMatch\":\"VulnId\",\"formatter\":5},{\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":6,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"Remediation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Severity\"],\"expandTopLevel\":true,\"finalBy\":\"VulnId\"},\"labelSettings\":[{\"columnId\":\"ResourceGroup\",\"label\":\"Resource group\"},{\"columnId\":\"TimeGenerated\",\"label\":\"Time generated\"}]}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Rapidly Automatically Remediate Vulnerabilities (PV-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-6-rapidly-and-automatically-remediate-vulnerabilities)\\r\\n\\r\\nRapidly and automatically deploy patches and updates to remediate vulnerabilities in your cloud resources. Use the appropriate risk-based approach to prioritize the remediation of the vulnerabilities. For example, more severe vulnerabilities in a higher value asset should be addressed as a higher priority. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Update Management for Virtual Machines in Azure](https://docs.microsoft.com/azure/automation/update-management/overview)
\\r\\n💡 [Manage Updates and Patches for Your Azure VMs](https://docs.microsoft.com/azure/automation/update-management/manage-updates-for-vm)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Conduct Regular Red Team Operations (PV-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-7-conduct-regular-red-team-operations)\\r\\n\\r\\nSimulate real-world attacks to provide a more complete view of your organization's vulnerability. Red team operations and penetration testing complement the traditional vulnerability scanning approach to discover risks.\\r\\n\\r\\n## Implementation\\r\\n💡 [Penetration Testing in Azure](https://docs.microsoft.com/azure/security/fundamentals/pen-testing)
\\r\\n💡 [Penetration Testing Rules of Engagement](https://www.microsoft.com/msrc/pentest-rules-of-engagement?rtc=1)
\\r\\n💡 [Microsoft Cloud Red Teaming](https://download.microsoft.com/download/C/1/9/C1990DBA-502F-4C2A-848D-392B93D9B9C3/Microsoft_Enterprise_Cloud_Red_Teaming.pdf)
\\r\\n💡 [Technical Guide to Information Security Testing and Assessment](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [SimuLand for Attack Simulation](https://www.microsoft.com/security/blog/2021/05/20/simuland-understand-adversary-tradecraft-and-improve-detection-strategies/)\\r\\n![Image Name](https://www.microsoft.com/security/blog/wp-content/uploads/2021/05/Map-of-threat-research.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Attack Simulator in the Security & Compliance Center](https://docs.microsoft.com/azure/automation/update-management/overview)\\r\\n![Image Name](https://docs.microsoft.com/microsoft-365/media/9bd65af4-1f9d-45c1-8c06-796d7ccfd425.jpg) \\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Posture & Vulnerability Management\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Endpoint Security (ES)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security) \\r\\n---\\r\\nEndpoint Security covers controls in endpoint detection and response, including use of endpoint detection and response (EDR) and anti-malware service for endpoints in Azure environments. \"},\"customWidth\":\"40\",\"name\":\"ES Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Endpoint Detection & Response (ES-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Modern Anti-Malware Software (ES-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Anti-Malware Software/Signature Updates (ES-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES3\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"75f1caed-7990-4221-bcb9-084b788cec87\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"3afd9d5a-2e29-476f-8508-478a4322a1a7\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Endpoint Detection & Response (ES-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-1-use-endpoint-detection-and-response-edr)\\r\\n\\r\\nEnable Endpoint Detection and Response (EDR) capabilities for VMs and integrate with SIEM and security operations processes.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Defender for Cloud introduction](https://docs.microsoft.com/azure/security-center/defender-for-servers-introduction)
\\r\\n💡 [Microsoft Defender for Endpoint Overview](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
\\r\\n💡 [Microsoft Defender for Cloud feature coverage for machines](https://docs.microsoft.com/azure/security-center/security-center-services?tabs=features-windows)
\\r\\n💡 [Connector for Defender for servers integration into SIEM](https://docs.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where RecommendationName contains \\\"endpoint protection\\\" or RecommendationName contains \\\"virus\\\" or RecommendationName contains \\\"defender for servers\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Description contains \\\"endpoint\\\" or Description contains \\\"EDR\\\" or Description contains \\\"virus\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: EDR\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Modern Anti-Malware Software (ES-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-2-use-modern-anti-malware-software)\\r\\n\\r\\nMicrosoft Defender for Cloud can automatically identify the use of a number of popular anti-malware solutions for your virtual machines and on-premises machines with Azure Arc configured, and report the endpoint protection running status and make recommendations.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Supported Endpoint Protection Solutions](https://docs.microsoft.com/azure/security-center/security-center-services?tabs=features-windows#supported-endpoint-protection-solutions-)
\\r\\n💡 [How to Configure Microsoft Antimalware for Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n🔀 [Microsoft Sentinel](https://ms.portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"ES.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"tool\\\" or Title contains \\\"mal\\\" or Title contains \\\"ware\\\" or Title contains \\\"mining\\\" or Title contains \\\"anti\\\" or Title contains \\\"exploit\\\" or Title contains \\\"inject\\\" or Title contains \\\"program\\\" or Title contains \\\"virus\\\" or Title contains \\\"worm\\\"\\r\\n| where Title !contains \\\"URL\\\"\\r\\n| where Title !contains \\\"net\\\"\\r\\n| where Title !contains \\\"web\\\"\\r\\n| where Title !contains \\\"normalization\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Malware\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Anti-Malware Software & Signatures are Updated (ES-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-3-ensure-anti-malware-software-and-signatures-are-updated)\\r\\n\\r\\nEnsure anti-malware signatures are updated rapidly and consistently for the anti-malware solution.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) 🔷 [ProtectionStatus](https://docs.microsoft.com/azure/azure-monitor/reference/tables/protectionstatus) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Deploy Microsoft Antimalware for Azure Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\\r\\n💡 [Endpoint protection assessment and recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-endpoint-protection)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"ES.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ProtectionStatus\\r\\n| project ResourceId, OSName, SignatureVersion, ProtectionStatus, ProtectionStatusDetails, TypeofProtection, ScanDate\\r\\n| sort by ScanDate desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Protection Status\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ProtectionStatus\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"No real time protection\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Signatures out of date\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Real time protection\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unknown\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Threat Detected\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Reporting\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"name\":\"query - 7 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-3\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Endpoint Security Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Backup & Recovery (BR)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery) \\r\\n---\\r\\nBackup and Recovery covers controls to ensure that data and configuration backups at the different service tiers are performed, validated, and protected.\"},\"customWidth\":\"40\",\"name\":\"BR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Regular Automated Backups (BR-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Protect Backup & Recovery Data (BR-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Monitor Backups (BR-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Regularly Test Backups (BR-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6ae2b31b-c2e7-4098-a83f-056deb37259e\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"c2825810-37fd-4aa3-810d-66a6fb91861b\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9359e468-1457-462f-ba71-063894d31a58\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Regular Automated Backups (BR-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-1-ensure-regular-automated-backups)\\r\\n\\r\\nEnsure backup of business-critical resources, either during resource creation or enforced through policy for existing resources. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable Azure Backup](https://learn.microsoft.com/en-us/azure/backup/)
\\r\\n💡 [Auto-Enable Backup on VM Creation using Azure Policy](https://docs.microsoft.com/azure/backup/backup-azure-auto-enable-backup)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"BR.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type contains \\\"recovery\\\"\\r\\n| project id,type,location,resourceGroup\\r\\n| order by location asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recovery Services Vaults\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Protect Backup & Recovery Data (BR-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-2-protect-backup-and-recovery-data)\\r\\n\\r\\nEnsure backup data and operations are protected from data exfiltration, data compromise, ransomware/malware and malicious insiders. The security controls that should be applied include user and network access control, data encryption at-rest and in-transit. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Overview of Security Features in Azure Backup](https://docs.microsoft.com/azure/backup/security-overview)
\\r\\n💡 [Encryption of Backup Data Using Customer-Managed Keys](https://docs.microsoft.com/azure/backup/encryption-at-rest-with-cmk)
\\r\\n💡 [Security features to help protect hybrid backups from attacks](https://docs.microsoft.com/azure/backup/backup-azure-security-feature#prevent-attacks)
\\r\\n💡 [Azure Backup - set cross region restore](https://docs.microsoft.com/azure/backup/backup-create-rs-vault#set-cross-region-restore)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"BR.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Monitor Backups (BR-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-3-monitor-backups)\\r\\n\\r\\nEnsure all business-critical protectable resources are compliant with the defined backup policy and standard. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Govern your backup estate using Backup Center](https://docs.microsoft.com/azure/backup/backup-center-govern-environment)
\\r\\n💡 [Monitor and operate backups using Backup center](https://docs.microsoft.com/azure/backup/backup-center-monitor-operate)
\\r\\n💡 [Monitoring and reporting solutions for Azure Backup](https://docs.microsoft.com/azure/backup/monitoring-and-alerts-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Center](https://portal.azure.com/#blade/Microsoft_Azure_DataProtection/BackupCenterMenuBlade/overview)\"},\"name\":\"BR-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue contains \\\"recovery\\\"\\r\\n| summarize count() by Caller\\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Users Interacting with Backups\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue contains \\\"recovery\\\"\\r\\n| project OperationName, Caller, OperationNameValue, ResourceId, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Backup Activity\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Regularly Test Backups (BR-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-4-regularly-test-backup)\\r\\n\\r\\nPeriodically perform data recovery tests of your backup to verify that the backup configurations and availability of the backup data meets the recovery needs as per defined in the RTO (Recovery Time Objective) and RPO (Recovery Point Objective).\\r\\n\\r\\n## Implementation\\r\\n💡 [How to recover files from Azure Virtual Machine backup](https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm)
\\r\\n💡 [How to restore Key Vault keys in Azure](https://learn.microsoft.com/en-us/powershell/module/az.keyvault/restore-azkeyvaultkey)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\\r\\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Regularly test backups](https://docs.microsoft.com/azure/backup/backup-overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/backup/media/backup-overview/azure-backup-overview.png) \\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isBR4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-4\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Backup & Recovery Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [DevOps Security (DS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security) \\r\\n---\\r\\nDevOps Security covers the controls related to the security engineering and operations in the DevOps processes, including deployment of critical security checks (such as static application security testing, vulnerability management) prior to the deployment phase to ensure the security throughout the DevOps process; it also includes common topics such as threat modeling and software supply security. \"},\"customWidth\":\"40\",\"name\":\"BR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Threat Modeling (DS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Software Supply Chain Security (DS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure DevOps Infrastructure (DS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Integrate Static Application Security Testing into DevOps Pipeline (DS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"432231f5-e330-4608-a6f0-2586469caa56\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"3cae8cdf-ea83-4785-ae80-bd30a12bb879\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"bdbb6088-a8a5-42fe-a440-cb4b07c58f06\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Integrate Dynamic Application Security Testing into DevOps Pipeline (DS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enforce Security of Workload throughout DevOps Lifecycle (DS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Logging & Monitoring in DevOps (DS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"448e20b4-58fd-4677-b2f4-3786a984351d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"8c41d5dc-518b-48b3-83df-2f6d065023a3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"263e3b56-f7f9-4c8d-b79e-5eb8c1c5f66a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Conduct Threat Modeling (DS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-1-conduct-threat-modeling)\\r\\n\\r\\nPerform threat modeling to identify the potential threats and enumerate the mitigating controls. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Threat Modeling Overview](https://www.microsoft.com/securityengineering/sdl/threatmodeling)
\\r\\n💡 [Application threat analysis (including STRIDE + questionnaire based method)](https://docs.microsoft.com/azure/architecture/framework/security/design-threat-model)
\\r\\n💡 [Azure Template - Microsoft Security Threat Model Stencil](https://github.com/AzureArchitecture/threat-model-templates)
\\r\\n💡 [Hunt for threats with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/hunting)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Getting started with the Threat Modeling Tool](https://docs.microsoft.com/azure/security/develop/threat-modeling-tool-getting-started)\\r\\n![Image Name](https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE2K1Za?ver=0327&q=90&m=8&h=450&w=800&b=%23FFFFFFFF&l=f&x=0&y=79&s=1709&d=961&aim=true)
\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Tactics <> \\\"[]\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Tactics\\r\\n| render timechart \\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"MITRE ATT&CK® Tactics Observed\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Software Supply Chain Security (DS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-2-ensure-software-supply-chain-security)\\r\\n\\r\\nEnsure your enterprise’s SDLC (Software Development Lifecycle) or process include a set of security controls to govern the in-house and third-party software components (including both proprietary and open-source software) where your applications have dependencies. Define gating criteria to prevent vulnerable or malicious components being integrated and deployed into the environment. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [GitHub Dependency Graph](https://docs.github.com/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)
\\r\\n💡 [GitHub Dependabot](https://docs.github.com/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)
\\r\\n💡 [Identify vulnerable container images in your CI/CD workflows](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-cicd)
\\r\\n💡 [Azure DevOps Marketplace – supply chain security](https://marketplace.visualstudio.com/search?term=tag%3ASupply%20Chain%20Security&target=VSTS)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where RecommendationName contains \\\"contain\\\" or RecommendationName contains \\\"aks\\\" or RecommendationName contains \\\"kube\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure DevOps Infrastructure (DS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-3-secure-devops-infrastructure)\\r\\n\\r\\nEnsure the DevOps infrastructure and pipeline follow security best practices across environments including your build, test, and production stages.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [GitHubAuditLogPolling_CL](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github) 🔷 [AzureDevOpsAuditing](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [DevSecOps controls overview – secure pipelines](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
\\r\\n💡 [Secure your GitHub organization](https://docs.github.com/code-security/getting-started/securing-your-organization)
\\r\\n💡 [Azure DevOps pipeline – Microsoft hosted agent security considerations](https://docs.microsoft.com/azure/devops/pipelines/agents/hosted?view=azure-devops&preserve-view=true&tabs=yaml#security)
\\r\\n💡 [Protecting your GitHub assets with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721)
\\r\\n💡 [Deploy Microsoft Sentinel: Continuous Threat Monitoring for GitHub Solution](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github)
\\r\\n💡 [Azure DevOps - audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops&preserve-view=true)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditLogPolling_CL \\r\\n| project actor_s, org_s, repo_s, action_s, name_s, _document_id_s, visibility_s, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"GitHub Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"actor_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"action_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDevOpsAuditing\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Azure DevOps Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Integrate Static Application Security Testing into DevOps Pipeline (DS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-4-integrate-static-application-security-testing-into-devops-pipeline)\\r\\n\\r\\nEnsure static application security testing (SAST) is part of the gating controls in the CI/CD workflow. The gating can be set based on the testing results to prevent vulnerable packages from committing into the repository, building into the packages, or deploying into the production. \\r\\n\\r\\n## Implementation\\r\\n💡 [GitHub CodeQL](https://codeql.github.com/docs/)
\\r\\n💡 [BinSkim Binary Analyzer](https://github.com/microsoft/binskim)
\\r\\n💡 [Azure DevOps Credential Scan](https://secdevtools.azurewebsites.net/helpcredscan.html)
\\r\\n💡 [GitHub secret scanning](https://docs.github.com/code-security/secret-security/about-secret-scanning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Getting started with Credential Scanner](https://secdevtools.azurewebsites.net/helpcredscan.html)\\r\\n![ImageName](https://secdevtools.azurewebsites.net/img/1_AddBuildTask.png)\"},\"customWidth\":\"50\",\"name\":\"text - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Integrate Dynamic Application Security Testing into DevOps Pipeline (DS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-5-integrate-dynamic-application-security-testing-into-devops-pipeline)\\r\\n\\r\\nEnsure dynamic application security testing (DAST) are part of the gating controls in the CI/CD workflow. The gating can be set based on the testing results to prevent vulnerability from building into the packages or deploying into the production. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityNestedRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [DAST tools in Azure DevOps marketplace](https://marketplace.visualstudio.com/search?term=DAST&target=AzureDevOps&category=All%20categories)
\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [Integrated Vulnerability Scanner for Virtual Machines](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [SQL Vulnerability Assessment](https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment)
\\r\\n💡 [Exporting Microsoft Defender for Cloud Vulnerability Scan Results](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityNestedRecommendation\\r\\n| extend CVE = tostring(parse_json(tostring(AdditionalData.Cve))[0].Title)\\r\\n| where Description <> \\\"\\\"\\r\\n| where Description <> \\\"N/A\\\"\\r\\n| summarize count() by Description, CVE\\r\\n| sort by count_ desc\\r\\n| project Description, CVE, count_\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" System/Application Vulnerabilities\",\"noDataMessage\":\"Confirm ASC SecurityNestedRecommendation logging is enabled and/or extend time thresholds for a larger data-set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Description\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Execution\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enforce Security of Workload throughout DevOps Lifecycle (DS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-6-enforce-security-of-workload-throughout-devops-lifecycle)\\r\\n\\r\\nEnsure the workload is secured throughout the entire lifecycle in development, testing, and deployment stage. Use Azure Security Benchmark to evaluate the controls (such as network security, identity management, privileged access and so on) that can be set as guardrails by default or shift left prior to the deployment stage. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Shared Image Gallery overview](https://docs.microsoft.com/azure/virtual-machines/windows/shared-image-galleries)
\\r\\n💡 [How to implement Azure Defender for Cloud vulnerability assessment recommendations](https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations)
\\r\\n💡 [Security considerations for Azure Container](https://docs.microsoft.com/azure/container-instances/container-instances-image-security)
\\r\\n💡 [Azure Defender for container registries](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-introduction)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Azure Security Benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DS.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Azure Security Benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Logging and Monitoring in DevOps (DS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-7-enable-logging-and-monitoring-in-devops)\\r\\n\\r\\nEnsure your logging and monitoring scope includes non-production environments and CI/CD workflow elements used in DevOps (and any other development processes). The vulnerabilities and threats targeting these environments can introduce significant risks to your production environment if they are not monitored properly. The events from the CI/CD build, test and deployment workflow should also be monitored to identify any deviations in the CI/CD workflow jobs. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [GitHubAuditLogPolling_CL](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github) 🔷 [AzureDevOpsAuditing](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure DevOps - audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops&preserve-view=true)
\\r\\n💡 [GitHub logging](https://docs.github.com/organizations/keeping-your-organization-secure/reviewing-the-audit-log-for-your-organization)
\\r\\n💡 [Protecting your GitHub assets with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721)
\\r\\n💡 [Deploy Microsoft Sentinel: Continuous Threat Monitoring for GitHub Solution](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Enable Azure DevOps Audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops)\\r\\n![Image](https://docs.microsoft.com/azure/devops/organizations/audit/media/auditing-streaming/create-new-auditing-stream.png?view=azure-devops)\"},\"customWidth\":\"50\",\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditLogPolling_CL \\r\\n| project actor_s, org_s, repo_s, action_s, name_s, _document_id_s, visibility_s, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"GitHub Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"actor_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"action_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDevOpsAuditing\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Azure DevOps Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DevOps Security\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Governance & Strategy (GS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy) \\r\\n---\\r\\nGovernance and Strategy provides guidance for ensuring a coherent security strategy and documented governance approach to guide and sustain security assurance, including establishing roles and responsibilities for the different cloud security functions, unified technical strategy, and supporting policies and standards. \"},\"customWidth\":\"40\",\"name\":\"GS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Align Organization Roles & Responsibilities (GS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define Enterprise Segmentation Strategy (GS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Data Protection Strategy (GS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Network Security Strategy (GS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement security Posture Management Strategy (GS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"bf30d754-c4b6-463d-9683-751c1d04c6be\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"faf2c7d2-4fba-42cb-b2af-46acfb3e86af\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6ce04d53-ba6b-4798-98ac-5e187cefa6ee\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"ed6784f0-b512-4d1f-bfdf-716b7cb92ca0\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Identity Strategy (GS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Logging & IR Strategy (GS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Backup & Recovery Strategy (GS-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Endpoint Security Strategy (GS-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS9\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement DevOps Security Strategy (GS-10)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS10\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"74a2acdf-58b1-4894-9751-df3d37c60c0a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"430132bd-1307-4751-9e7c-d8e5d4c35a60\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"60452be3-bb0d-46b6-8b64-a0dd85f8c184\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"ab4776ea-1780-4461-b79e-0158cd70dcfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7b8c13cd-cea6-40ff-b96d-f533b1cadd04\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS10Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS10\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Align Organization Roles, Responsibilities & Accountabilities (GS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-1-align-organization-roles-responsibilities-and-accountabilities)\\r\\n\\r\\nEnsure that you define and communicate a clear strategy for roles and responsibilities in your security organization. Prioritize providing clear accountability for security decisions, educating everyone on the shared responsibility model, and educate technical teams on technology to secure the cloud.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Best Practice 1 – People: Educate Teams on Cloud Security Journey](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#1-people-educate-teams-about-the-cloud-security-journey)
\\r\\n💡 [Azure Security Best Practice 2 - People: Educate Teams on Cloud Security Technology](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#2-people-educate-teams-on-cloud-security-technology)
\\r\\n💡 [Azure Security Best Practice 3 - Process: Assign Accountability for Cloud Security Decisions](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#4-process-update-incident-response-ir-processes-for-cloud)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Align Organization Roles, Responsibilities, and Accountabilities](https://docs.microsoft.com/security/zero-trust/identity)\\r\\n![Image Name](https://docs.microsoft.com/azure/role-based-access-control/media/rbac-and-directory-admin-roles/rbac-admin-roles.png)\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS1\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [GS-2: Define & Implement Enterprise Segmentation/Separation of Duties Strategy (GS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy)\\r\\n\\r\\nEstablish an enterprise-wide strategy to segment access to assets using a combination of identity, network, application, subscription, management group, and other controls.\\r\\n\\r\\n## Strategy\\r\\n💡 [Security in the Microsoft Cloud Adoption Framework for Azure - Segmentation: Separate to Protect](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/access-control#segmentation-separate-to-protect)
\\r\\n💡 [Security in the Microsoft Cloud Adoption Framework for Azure - Architecture: Establish Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Segment and Enforce the External Boundaries](https://docs.microsoft.com/security/zero-trust/networks#segment-and-enforce-the-external-boundaries)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-servers-devices-boundaries-azure-vpn.png) \\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Data Protection Strategy (GS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-3-define-and-implement-data-protection-strategy)\\r\\n\\r\\nEstablish an enterprise-wide strategy for data protection in Azure\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Data Protection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection)
\\r\\n💡 [Cloud Adoption Framework - Azure data security and encryption best practices](https://docs.microsoft.com/azure/security/fundamentals/data-encryption-best-practices)
\\r\\n💡 [Azure Security Fundamentals - Azure Data security, encryption, and storage](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview)
\"},\"name\":\"GS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Asset Management and Data Protection Strategy](https://docs.microsoft.com/security/zero-trust/data)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-monitor-remediate-data.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS1\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Network Security Strategy (GS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-4-define-and-implement-network-security-strategy)\\r\\n\\r\\nEstablish an Azure network security strategy as part of your organization's overall security strategy for access control.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\\r\\n💡 [Azure Security Benchmark - Network Security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)
\\r\\n💡 [Azure Network Security Overview](https://docs.microsoft.com/azure/security/fundamentals/network-overview)
\\r\\n💡 [Enterprise Network Architecture Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture)
\"},\"name\":\"GS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Network Security Strategy](https://docs.microsoft.com/security/zero-trust/networks)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-azure-region-virtual-network-servers.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS5\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Security Posture Management Strategy (GS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-5-define-and-implement-security-posture-management-strategy)\\r\\n\\r\\nEstablish a policy, procedure and standard to ensure the security configuration management and vulnerability management are in place in your cloud security mandate.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Posture and Vulnerability Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)
\\r\\n💡 [Azure Security Best Practice 9 - Establish security posture management](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#5-process-establish-security-posture-management)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Security Posture Management Strategy](https://docs.microsoft.com/security/zero-trust/visibility-automation-orchestration)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-provide-integrated-capabilities-manage-threats.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Identity & Privileged Access Strategy (GS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy)\\r\\n\\r\\nEstablish an Azure identity and privileged access approach as part of your organization's overall security access control strategy. \\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Identity Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management)
\\r\\n💡 [Azure Security Benchmark - Privileged Access](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access)
\\r\\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\\r\\n💡 [Azure Identity Management Security Overview](https://docs.microsoft.com/azure/security/fundamentals/identity-management-overview)
\"},\"name\":\"GS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Identity and Privileged Access Strategy](https://docs.microsoft.com/security/zero-trust/identity)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-conditional-access-policies.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS6\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Logging, Threat Detection & Incident Response Strategy (GS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy)\\r\\n\\r\\nEstablish a logging, threat detection and incident response strategy to rapidly detect and remediate threats and meeting compliance requirements. Security operations (SecOps / SOC) team should prioritize high quality alerts and seamless experiences so that they can focus on threats rather than log integration and manual steps.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Logging and Threat Detection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection)
\\r\\n💡 [Azure Security Benchmark - Incident Response](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)
\\r\\n💡 [Azure Security Best Practice 4 - Process. Update Incident Response Processes for Cloud](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\\r\\n💡 [Azure Adoption Framework, Logging, and Reporting Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/)
\\r\\n💡 [Azure Enterprise Scale, Management, and Monitoring](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/management-and-monitoring)
\"},\"name\":\"GS-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Logging and Threat Response Strategy](https://docs.microsoft.com/azure/sentinel/overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/sentinel/media/overview/core-capabilities.png) \\r\\n\"},\"customWidth\":\"35\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS7\",\"styleSettings\":{\"maxWidth\":\"35\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Backup & Recovery Strategy (GS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy)\\r\\n\\r\\nEstablish an Azure backup and recovery strategy for your organization. \\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Backup and Recovery](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery)
\\r\\n💡 [Azure Well-Architecture Framework - Backup and Disaster Recover for Azure Applications](https://docs.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery)
\\r\\n💡 [Azure Adoption Framework - Business Continuity and Disaster Recovery](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery)
\\r\\n💡 [Backup and restore plan to protect against ransomware](https://docs.microsoft.com/azure/security/fundamentals/backup-plan-to-protect-against-ransomware)
\"},\"name\":\"GS-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Backup and Recovery Strategy](https://docs.microsoft.com/azure/backup/backup-overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/backup/media/backup-overview/azure-backup-overview.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Endpoint Security Strategy (GS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-9-define-and-implement-endpoint-security-strategy)\\r\\n\\r\\nEstablish a cloud endpoint security strategy.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - Endpoint security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)
\\r\\n💡 [Best practices for endpoint security on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-endpoints)
\"},\"name\":\"GS-9\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Endpoint Security Strategy](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)\\r\\n![Image Name](https://docs.microsoft.com/microsoft-365/media/mde-p1/mde-p1-overview-diagram.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement DevOps Security Strategy (GS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-10-define-and-implement-devops-security-strategy)\\r\\n\\r\\nMandate the security controls as part of the organization's DevOps engineering and operation standard. Define the security objectives, control requirements, and tooling specifications in accordance with enterprise and cloud security standards in your organization.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Benchmark - DevOps security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security)
\\r\\n💡 [Secure DevOps](https://www.microsoft.com/securityengineering/devsecops)
\\r\\n💡 [Cloud Adoption Framework - DevSecOps controls](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
\"},\"name\":\"GS-10\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define and implement DevOps security strategy](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security?WT.mc_id=Portal-fx)\\r\\n![Image Name](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/media/devsecops-controls.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS10Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Governance & Strategy Group\"}],\"fromTemplateId\":\"sentinel-AzureSecurityBenchmark\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a4b4e975-fa7c-46a3-b669-850aacc88134\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"🔎 Getting Started\",\"type\":10,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\"}\\r\\n]\",\"value\":\"No\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"id\":\"314d02bf-4691-43fa-af59-d67073c8b8fa\"},{\"id\":\"e6ded9a1-a83c-4762-938d-5bf8ff3d3d38\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"e3225ed0-6210-40a1-b2d0-66e42ffa71d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| order by name asc\\r\\n| summarize Selected = makelist(id, 10), All = makelist(id, 1000)\\r\\n| mvexpand All limit 100\\r\\n| project value = tostring(All), label = tostring(All), selected = iff(Selected contains All, true, false)\",\"crossComponentResources\":[\"{Subscription}\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"15b2c181-7397-43c1-900a-28e175ae8a6f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Parameter Selectors\"},{\"type\":1,\"content\":{\"json\":\"  Please take time to answer a quick survey,\\r\\n[ click here. ](https://forms.office.com/r/sxvBsuTcmM)\"},\"name\":\"Survey\"},{\"type\":1,\"content\":{\"json\":\"## Getting Started\\r\\nThis solution leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align directly with the Microsoft cloud security benchmark. A filter set in guide, subscription, workspace, time, and ASB control are available for customized reporting and review. The documentation below provides getting started recommendations for centralizing log analytics data and enabling Microsoft Defender for Cloud Continuous Export. This offering includes integration with Microsoft 1st Party, Partner 3rd Party ecosystem, hybrid, on-premises, and multi-cloud workloads. Common use cases include conducting ASB assessments which custom reporting, time filtering, subscription filtering, workspace filtering, and guides. The report is exportable for print or PDF with the Print Workbook feature. The solution is organized by ASB control areas, each area has multiple control cards. Control cards include ASB logging over time, current ASB assessment recommendations, ASB status, documentation guides, recommendations, and links to product pages, documentation, and portals for all referenced products.
\\r\\n\\r\\n### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions)\\r\\n| Roles | Rights | \\r\\n|:--|:--|\\r\\n|Security Reader | View solutions, Analytics, Security Recommendations |\\r\\n|Security Contributor| Deploy/Modify solutions, Analytics, Apply Security Recommendations |\\r\\n|Owner| Assign Regulatory Compliance Initiatives|\\r\\n\\r\\n### Onboarding Prerequisites \\r\\n1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
\\r\\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\\r\\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\\r\\n4️⃣ [Add the Microsoft cloud security benchmark Assessment to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\\r\\n5️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n6️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\\r\\n7️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
\\r\\n8️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
\\r\\n\\r\\n### Print/Export Report\\r\\n1️⃣ Set Background Theme: Settings > Appearance > Theme: Azure > Apply
\\r\\n2️⃣ Print/Export Report: More Content Actions (...) > Print Content
\\r\\n3️⃣ Settings: Layout (Landscape), Pages (All), Print (One Sided), Scale (60), Pages Per Sheet (1), Quality (1,200 DPI), Margins (None) > Print
\\r\\n4️⃣ Executive Summary: Microsoft Defender for Cloud > Regulatory Compliance > Download Report > Report Standard (Microsoft cloud security benchmark), Format (PDF)\\r\\n\\r\\n### Important\\r\\nThis solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All requirements, validations, and controls are governed by respective organizations. This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. \",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"Help\"},{\"type\":1,\"content\":{\"json\":\"# [Microsoft cloud security benchmark v3](https://docs.microsoft.com/security/benchmark/azure/)\\n---\\n\\nThe Microsoft cloud security benchmark v3 Solution is designed to enable Cloud Architects, Security Engineers, and Governance Risk Compliance Professionals to gain situational awareness for cloud security posture and hardening. Benchmark recommendations provide a starting point for selecting specific security configuration settings and facilitate risk reduction. The Microsoft cloud security benchmark includes a collection of high-impact security recommendations for improving posture. This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. \"},\"customWidth\":\"79\",\"name\":\"Workbook Overview\"},{\"type\":1,\"content\":{\"json\":\"![Image Name](https://azure.microsoft.com/svghandler/azure-sentinel?width=600&height=315) \"},\"customWidth\":\"20\",\"name\":\"Microsoft Sentinel Logo\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Posture Assessment\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AT\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Controls Crosswalk\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"CMA\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Network Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Identity Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Privileged Access\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Data Protection\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Asset Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Section\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"Control Areas\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a30d01d0-38f1-4a91-9cf6-cdb181d676b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isATVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AT\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"c01e9b8b-b285-4aae-8510-68741e0315c3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isCMAVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"CMA\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"d41cb044-86ef-4603-ae24-c61e864c067d\"},{\"id\":\"7b682fc9-cb6b-4475-a24c-41dcb43d0cef\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIMVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPAVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"15158143-a4f8-417b-90b0-123dd13f1ff5\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDPVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"0077d493-a27d-49d7-b49d-5888805d501e\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAMVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"33690532-5a73-4ac3-8fbd-6fc449a6d166\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Logging & Threat Detection\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Incident Response\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Posture & Vulnerability Management\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Endpoint Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Backup & Recovery\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"DevOps Security\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control Area\\\\\\\": \\\\\\\"Governance & Strategy\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Section\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"Control Areas - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLTVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"b7db9449-1027-45a8-a5c1-2eb371722ba6\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIRVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"26b9ae7c-7cfe-4606-8318-d7ff172a1e1a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPVVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"0ece4c93-cbf9-4b8c-a0ad-ddfa6635919a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isESVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"ebead9f9-b4cc-4ab4-9c06-a5d9ac643825\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBRVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"dcd1bbe4-4979-4459-8b8b-3d2a3f6f7783\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"342935cc-8a23-46f8-96a6-974808db01c5\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGSVisible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"a00fd6f7-5f8d-487d-948f-804ab0288aae\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Posture Assessment](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\\r\\n---\\r\\nThe Posture Assessment section provides a mechanism to find, fix, and resolve Microsoft cloud security benchmark recommendations. A selector provides capability to filter by all, specific, or groups of control families. Upon selection, subordinate panels will summarize recommendations by control family, status over time, recommendations, and resources identified with deep-link for remediation.\"},\"customWidth\":\"40\",\"name\":\"NS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"10\",\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{Workspace}\"],\"parameters\":[{\"id\":\"99a47f97-1aa4-4840-91ee-119aad6d6217\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ComplianceDomain\",\"label\":\"Control Area\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| where ComplianceStandard == \\\"Microsoft-cloud-security-benchmark\\\"\\r\\n| extend ComplianceDomain=iff(ComplianceControl contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ComplianceControl contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ComplianceControl contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ComplianceControl contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ComplianceControl contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ComplianceControl contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ComplianceControl contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ComplianceControl contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ComplianceControl contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ComplianceControl contains \\\"NS.\\\", \\\"Network Security\\\", iff(ComplianceControl contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ComplianceControl contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| summarize count() by ComplianceDomain\\r\\n| sort by count_ desc\\r\\n| project-away count_\\r\\n\",\"crossComponentResources\":[\"{Workspace}\"],\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"40\",\"name\":\"parameters - 26\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink) on RecommendationName\\r\\n| extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain has (ComplianceDomain) \\r\\n | distinct RecommendationName, ComplianceDomain, tostring(RecommendationLink), tostring(state), tostring(complianceState)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\" or complianceState == \\\"Failed\\\") by ComplianceDomain\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n | project ControlFamily=ComplianceDomain, Total, PassedControls, Passed, Failed\\r\\n | sort by Total, Passed desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations by Control Area\",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_compositeBar_Total_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_compositeBar_Total_1\",\"sortOrder\":2}]},\"customWidth\":\"50\",\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName\\r\\n| extend ComplianceDomain=iff(ControlID contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ControlID contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ControlID contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ControlID contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ControlID contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ControlID contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ControlID contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ControlID contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ControlID contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ControlID contains \\\"NS.\\\", \\\"Network Security\\\", iff(ControlID contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ControlID contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain has (ComplianceDomain) \\r\\n| extend Remediate=RecommendationLink\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain has (ComplianceDomain) \\r\\n| distinct RecommendationName, resourceId, tostring(state), tostring(complianceState)\\r\\n| summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\") by resourceId\\r\\n| extend PassedControls = (Passed/todouble(Total))*100\\r\\n| where Failed > 0\\r\\n| project AssessedResourceId=resourceId, Total, PassedControls, Passed, Failed\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations by Asset\",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AssessedResourceId\",\"formatter\":13,\"formatOptions\":{\"linkTarget\":\"Resource\",\"showIcon\":true}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| where ComplianceStandard == \\\"Microsoft-cloud-security-benchmark\\\"\\r\\n| extend ComplianceDomain=iff(ComplianceControl contains \\\"AM.\\\", \\\"Asset Management\\\", iff(ComplianceControl contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(ComplianceControl contains \\\"DP.\\\", \\\"Data Protection\\\", iff(ComplianceControl contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(ComplianceControl contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(ComplianceControl contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(ComplianceControl contains \\\"IM.\\\", \\\"Identity Management\\\", iff(ComplianceControl contains \\\"IR.\\\", \\\"Incident Response\\\", iff(ComplianceControl contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(ComplianceControl contains \\\"NS.\\\", \\\"Network Security\\\", iff(ComplianceControl contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(ComplianceControl contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain in ({ComplianceDomain})\\r\\n| where State == \\\"Failed\\\"\\r\\n| make-series count() default=0 on TimeGenerated from startofday({TimeRange:start}) to startofday({TimeRange:end}) step 1d by ComplianceDomain\\r\\n| render timechart \",\"size\":0,\"showAnalytics\":true,\"title\":\"Recommendations over Time\",\"noDataMessage\":\"No failed controls observed within these thresholds. Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and onboarded to Microsoft Sentinel Workspace.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]}},\"customWidth\":\"50\",\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend ComplianceDomain=iff(controlId contains \\\"AM.\\\", \\\"Asset Management\\\", iff(controlId contains \\\"BR.\\\", \\\"Backup & Recovery\\\", iff(controlId contains \\\"DP.\\\", \\\"Data Protection\\\", iff(controlId contains \\\"DS.\\\", \\\"DevOps Security\\\", iff(controlId contains \\\"ES.\\\", \\\"Endpoint Security\\\", iff(controlId contains \\\"GS.\\\", \\\"Governance & Strategy\\\", iff(controlId contains \\\"IM.\\\", \\\"Identity Management\\\", iff(controlId contains \\\"IR.\\\", \\\"Incident Response\\\", iff(controlId contains \\\"LT.\\\", \\\"Logging & Threat Detection\\\", iff(controlId contains \\\"NS.\\\", \\\"Network Security\\\", iff(controlId contains \\\"PA.\\\", \\\"Privileged Access\\\", iff(controlId contains \\\"PV.\\\", \\\"Posture & Vulnerability Management\\\",\\\"Other\\\"))))))))))))\\r\\n| where ComplianceDomain has (ComplianceDomain) \\r\\n| where state == \\\"Unhealthy\\\"\\r\\n| extend FirstObserved = properties1.status.statusChangeDate\\r\\n| parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| project ResourceID=resourceId, RecommendationName, ControlFamily=ComplianceDomain, ControlID=controlId, Severity=severity, CurrentState=state, Remediate=RecommendationLink, FirstObserved, assessmentKey\\r\\n| extend Rank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, 0)))\\r\\n| sort by Rank desc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Current Recommendation Details\",\"noDataMessage\":\"No failed controls observed within these thresholds. Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and onboarded to Microsoft Sentinel Workspace.\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ResourceID\",\"formatter\":13,\"formatOptions\":{\"linkTarget\":\"Resource\",\"showIcon\":true}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlFamily\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"linkIsContextBlade\":false,\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"FirstObserved\",\"formatter\":6},{\"columnMatch\":\"assessmentKey\",\"formatter\":5},{\"columnMatch\":\"Rank\",\"formatter\":5}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Severity_4\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Severity_4\",\"sortOrder\":1}]},\"name\":\"query - 8\"}]},\"conditionalVisibility\":{\"parameterName\":\"isATVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Assessment\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Controls Crosswalk](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)\\r\\n---\\r\\nControls crosswalk provides a mapping of Microsoft cloud security benchmark v3 controls across additional compliance frameworks. This provides free-text search capabilities mapping numerous frameworks including CIS v8, NIST SP 800-53 R4, and PCI-DSS v3. There is also a mapping for recommended Microsoft products for each of these control requirements. \"},\"customWidth\":\"40\",\"name\":\"Controls Mapping\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Crosswalk = datatable([\\\"Control Name\\\"]: string, [\\\"ASB v3\\\"]: string, [\\\"Control Area\\\"]: string, [\\\"CIS v8\\\"]: string, [\\\"NIST SP 800-53 R4\\\"]: string, [\\\"PCI-DSS v3\\\"]: string, [\\\"Recommended Products\\\"]: string) [\\r\\n\\\"NS-1: Establish network segmentation boundaries\\\",\\t\\\"NS-1\\\",\\t\\\"Network Security\\\",\\t\\\"3.12 | 13.4 | 4.4\\\",\\t\\\"\\tAC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"VirtualNetwork\\\",\\r\\n\\\"NS-2: Secure cloud services with network controls\\\",\\t\\\"NS-2\\\",\\t\\\"Network Security\\\",\\t\\\"3.12 | 4.4\\\",\\t\\\"AC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Virtual Network | Private Link\\\",\\r\\n\\\"NS-3: Deploy firewall at the edge of enterprise network\\\",\\t\\\"NS-3\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8 | 13.10\\\",\\t\\\"AC-4 | SC-7 | CM-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Firewall\\\",\\r\\n\\\"NS-4: Deploy intrusion detection/intrusion prevention systems (IDS/IPS)\\\",\\t\\\"NS-4\\\",\\t\\\"Network Security\\\",\\t\\\"13.2 | 13.3 | 13.7 | 13.8\\\",\\t\\\"SC-7 | SI-4\\\",\\t\\\"11.4\\\",\\t\\\"Azure Firewall | Microsoft Defender for Endpoint\\\",\\r\\n\\\"NS-5: Deploy DDOS protection\\\",\\t\\\"NS-5\\\",\\t\\\"Network Security\\\",\\t\\\"13.1\\\",\\t\\\"SC-5 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3 | 6.6\\\",\\t\\\"Azure DDoS Protection\\\",\\r\\n\\\"NS-6: Deploy web application firewall\\\",\\t\\\"NS-6\\\",\\t\\\"Network Security\\\",\\t\\\"13.1\\\",\\t\\\"SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Web Application Firewall\\\",\\r\\n\\\"NS-7: Simplify network security configuration\\\",\\t\\\"NS-7\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8\\\",\\t\\\"AC-4 | SC-2 | SC-7\\\",\\t\\\"1.1 | 1.2 | 1.3\\\",\\t\\\"Azure Firewall Manager\\\",\\r\\n\\\"NS-8: Detect and disable insecure services and protocols\\\",\\t\\\"NS-8\\\",\\t\\\"Network Security\\\",\\t\\\"4.4 | 4.8\\\",\\t\\\"CM-2 | CM-6 | CM-7\\\",\\t\\\"4.1 | A2.1 | A2.2 | A2.3\\\",\\t\\\"Microsoft Sentinel | Azure Active Directory | Microsoft Defender for Endpoint\\\",\\r\\n\\\"NS-9: Connect on-premises or cloud network privately\\\",\\t\\\"NS-9\\\",\\t\\\"Network Security\\\",\\t\\\"12.7\\\",\\t\\\"CA-3 | AC-17 | AC-4\\\",\\t\\\"N/A\\\",\\t\\\"VPN Gateway | Azure ExpressRoute | Virtual Network\\\",\\r\\n\\\"NS-10: Ensure Domain Name System (DNS) security\\\",\\t\\\"NS-10\\\",\\t\\\"Network Security\\\",\\t\\\"4.9 | 9.2\\\",\\t\\\"SC-20 | SC-21\\\",\\t\\\"N/A\\\",\\t\\\"Azure DNS\\\",\\r\\n\\\"IM-1: Use centralized identity and authentication system\\\",\\t\\\"IM-1\\\",\\t\\\"Identity Management\\\",\\t\\\"6.7 | 12.5\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-8\\\",\\t\\\"7.2 | 8.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-2: Protect identity and authentication systems\\\",\\t\\\"IM-2\\\",\\t\\\"Identity Management\\\",\\t\\\"5.4 | 6.5\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-8 | SI-4\\\",\\t\\\"8.2, 8.3\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-3: Manage application identities securely and automatically\\\",\\t\\\"IM-3\\\",\\t\\\"Identity Management\\\",\\t\\\"N/A\\\",\\t\\\"N/A\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-4: Authenticate server and services\\\",\\t\\\"IM-4\\\",\\t\\\"Identity Management\\\",\\t\\\"N/A\\\",\\t\\\"IA-9\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"IM-5: Use single sign-on (SSO) for application access\\\",\\t\\\"IM-5\\\",\\t\\\"Identity Management\\\",\\t\\\"12.5\\\",\\t\\\"IA-4 | IA-2 | IA-8\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-6: Use strong authentication controls\\\",\\t\\\"IM-6\\\",\\t\\\"Identity Management\\\",\\t\\\"6.3 | 6.4\\\",\\t\\\"AC-2 | AC-3 | IA-2 | IA-5 | IA-8\\\",\\t\\\"7.2 | 8.2 | 8.3 | 8.4\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"IM-7: Restrict resource access based on conditions\\\",\\t\\\"IM-7\\\",\\t\\\"Identity Management\\\",\\t\\\"3.3 | 6.4 | 13.5\\\",\\t\\\"AC-2 | AC-3 | AC-6\\\",\\t\\\"7.2\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"IM-8: Restrict the exposure of credential and secrets\\\",\\t\\\"IM-8\\\",\\t\\\"Identity Management\\\",\\t\\\"16.9 | 16.12\\\",\\t\\\"IA-5\\\",\\t\\\"3.5 | 6.3 | 8.2\\\",\\t\\\"Microsoft Sentinel | Azure Active Directory | Microsoft Defender for Endpoint\\\",\\r\\n\\\"IM-9: Secure user access to existing applications\\\",\\t\\\"IM-9\\\",\\t\\\"Identity Management\\\",\\t\\\"6.7 | 12.5\\\",\\t\\\"AC-2 | AC-3 | SC-11\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud Apps\\\",\\r\\n\\\"PA-1: Separate and limit highly privileged/administrative users\\\",\\t\\\"PA-1\\\",\\t\\\"Privileged Access\\\",\\t\\\"5.4 | 6.8\\\",\\t\\\"AC-2 | AC-6\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-2: Avoid standing access for user accounts and permissions\\\",\\t\\\"PA-2\\\",\\t\\\"Privileged Access\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"AC-2\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PA-3: Manage lifecycle of identities and entitlements\\\",\\t\\\"PA-3\\\",\\t\\\"Privileged Access\\\",\\t\\\"N/A\\\",\\t\\\"AC-5 | AC-6\\\",\\t\\\"7.1 | 7.2 | 8.1\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-4: Review and reconcile user access regularly\\\",\\t\\\"PA-4\\\",\\t\\\"Privileged Access\\\",\\t\\\"5.1 | 5.3 | 5.5\\\",\\t\\\"5.1 | 5.3 | 5.5\\\",\\t\\\"7.1 | 7.2 | 8.1 | A3.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-5: Set up emergency access\\\",\\t\\\"PA-5\\\",\\t\\\"Privileged Access\\\",\\t\\\"N/A\\\",\\t\\\"AC-2\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-6: Use privileged access workstations\\\",\\t\\\"PA-6\\\",\\t\\\"Privileged Access\\\",\\t\\\"12.8 | 13.5\\\",\\t\\\"AC-2 | SC-2 | SC-7\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"PA-7: Follow just enough administration (least privilege) principles\\\",\\t\\\"PA-7\\\",\\t\\\"Privileged Access\\\",\\t\\\"3.3 | 6.8\\\",\\t\\\"AC-2 | AC-3 | AC-6\\\",\\t\\\"7.1 | 7.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"PA-8: Determine access process for cloud provider support\\\",\\t\\\"PA-8\\\",\\t\\\"Privileged Access\\\",\\t\\\"6.1 | 6.2\\\",\\t\\\"AC-4 | AC-2 | AC-3\\\",\\t\\\"N/A\\\",\\t\\\"Customer Lockbox\\\",\\r\\n\\\"DP-1: Discover | classify | and label sensitive data\\\",\\t\\\"DP-1\\\",\\t\\\"Data Protection\\\",\\t\\\"3.2 | 3.7 | 3.13\\\",\\t\\\"RA-2 | SC-28\\\",\\t\\\"A3.2\\\",\\t\\\"Azure Information Protection\\\",\\r\\n\\\"DP-2: Monitor anomalies and threats targeting sensitive data\\\",\\t\\\"DP-2\\\",\\t\\\"Data Protection\\\",\\t\\\"3.13\\\",\\t\\\"AC-4 | SI-4\\\",\\t\\\"A3.2\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Sentinel\\\",\\r\\n\\\"DP-3: Encrypt sensitive data in transit\\\",\\t\\\"DP-3\\\",\\t\\\"Data Protection\\\",\\t\\\"3.1\\\",\\t\\\"SC-8\\\",\\t\\\"3.5 | 3.6 | 4.1\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DP-4: Enable data at rest encryption by default\\\",\\t\\\"DP-4\\\",\\t\\\"Data Protection\\\",\\t\\\"3.11\\\",\\t\\\"SC-28\\\",\\t\\\"3.4 | 3.5\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DP-5: Use customer-managed key option in data at rest encryption when required\\\",\\t\\\"DP-5\\\",\\t\\\"Data Protection\\\",\\t\\\"3.11\\\",\\t\\\"SC-12 | SC-28\\\",\\t\\\"3.4 | 3.5 | 3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"DP-6: Use a secure key management process\\\",\\t\\\"DP-6\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-28\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"DP-7: Use a secure certificate management process\\\",\\t\\\"DP-7\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-17\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Sentinel\\\",\\r\\n\\\"DP-8: Ensure security of key and certificate repository\\\",\\t\\\"DP-8\\\",\\t\\\"Data Protection\\\",\\t\\\"N/A\\\",\\t\\\"IA-5 | SC-12 | SC-17\\\",\\t\\\"3.6\\\",\\t\\\"Microsoft Defender for Cloud | Key Vault\\\",\\r\\n\\\"AM-1: Track asset inventory and their risks\\\",\\t\\\"AM-1\\\",\\t\\\"Asset Management\\\",\\t\\\"1.1 | 1.5 | 2.1 | 2.4\\\",\\t\\\"CM-8 | PM-5\\\",\\t\\\"2.4\\\",\\t\\\"Azure Resource Graph\\\",\\r\\n\\\"AM-2: Use only approved services\\\",\\t\\\"AM-2\\\",\\t\\\"Asset Management\\\",\\t\\\"2.5 | 2.6 | 2.7 | 4.8\\\",\\t\\\"CM-8 | PM-5\\\",\\t\\\"6.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Resource Graph\\\",\\r\\n\\\"AM-3: Ensure security of asset lifecycle management\\\",\\t\\\"AM-3\\\",\\t\\\"Asset Management\\\",\\t\\\"1.1 | 2.1\\\",\\t\\\"CM-8 | CM-7\\\",\\t\\\"2.4\\\",\\t\\\"Azure Monitor\\\",\\r\\n\\\"AM-4: Limit access to asset management\\\",\\t\\\"AM-4\\\",\\t\\\"Asset Management\\\",\\t\\\"3.3\\\",\\t\\\"AC-3\\\",\\t\\\"N/A\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"AM-5: Use only approved applications in virtual machine\\\",\\t\\\"AM-5\\\",\\t\\\"Asset Management\\\",\\t\\\"2.5 | 2.6 | 2.7 | 4.8\\\",\\t\\\"CM-8 | CM-7 | CM-10 | CM-11\\\",\\t\\\"6.3\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"LT-1: Enable threat detection capabilities\\\",\\t\\\"LT-1\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.6 | 10.8 | A3.5\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Microsoft Defender for Cloud Apps | Azure Active Directory | Microsoft Defender for Endpoint | Microsoft Defender for Office 365\\\",\\r\\n\\\"LT-2: Enable threat detection for identity and access management\\\",\\t\\\"LT-2\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.6 | 10.8 | A3.5\\\",\\t\\\"Microsoft Defender for Cloud | Azure Active Directory\\\",\\r\\n\\\"LT-3: Enable logging for security investigation\\\",\\t\\\"LT-3\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.2 | 8.5 | 8.12\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.1 | 10.2 | 10.3\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-4: Enable network logging for security investigation\\\",\\t\\\"LT-4\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.2 | 8.5 | 8.6 | 8.7 | 13.6\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Defender for Cloud | Azure Firewall | Azure Web Application Firewall | Application Gateway | Virtual Network | Azure Resource Graph\\\",\\r\\n\\\"LT-5: Centralize security log management and analysis\\\",\\t\\\"LT-5\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.9 | 8.11 | 13.1\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-6: Configure log storage retention\\\",\\t\\\"LT-6\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.3 | 8.10\\\",\\t\\\"AU-11\\\",\\t\\\"10.5 | 10.7\\\",\\t\\\"Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"LT-7: Use approved time synchronization sources\\\",\\t\\\"LT-7\\\",\\t\\\"Logging & Threat Detection\\\",\\t\\\"8.4\\\",\\t\\\"AU-8\\\",\\t\\\"10.4\\\",\\t\\\"Azure Active Directory Domain Services | Azure Policy | Virtual Machines\\\",\\r\\n\\\"IR-1: Preparation - update incident response plan and handling process\\\",\\t\\\"IR-1\\\",\\t\\\"Incident Response\\\",\\t\\\"17.4 | 17.7\\\",\\t\\\"IR-4 | IR-8\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"IR-2: Preparation - setup incident notification\\\",\\t\\\"IR-2\\\",\\t\\\"Incident Response\\\",\\t\\\"17.1 | 17.3 | 17.6\\\",\\t\\\"IR-4 | IR-8 | IR-5 | IR-6\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Logic Apps\\\",\\r\\n\\\"IR-3: Detection and analysis - create incidents based on high-quality alerts\\\",\\t\\\"IR-3\\\",\\t\\\"Incident Response\\\",\\t\\\"17.9\\\",\\t\\\"IR-4 | IR-5 | IR-7\\\",\\t\\\"10.8\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud\\\",\\r\\n\\\"IR-4: Detection and analysis - investigate an incident\\\",\\t\\\"IR-4\\\",\\t\\\"Incident Response\\\",\\t\\\"N/A\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"IR-5: Detection and analysis - prioritize incidents\\\",\\t\\\"IR-5\\\",\\t\\\"Incident Response\\\",\\t\\\"17.4 | 17.9\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud\\\",\\r\\n\\\"IR-6: Containment | eradication and recovery - automate the incident handling\\\",\\t\\\"IR-6\\\",\\t\\\"Incident Response\\\",\\t\\\"N/A\\\",\\t\\\"IR-4 | IR-5 | IR-6\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Azure Logic Apps\\\",\\r\\n\\\"IR-7: Post-incident activity - conduct lesson learned and retain evidence\\\",\\t\\\"IR-7\\\",\\t\\\"Incident Response\\\",\\t\\\"17.8\\\",\\t\\\"IR-4\\\",\\t\\\"12.1\\\",\\t\\\"Microsoft Sentinel | Azure Logic Apps\\\",\\r\\n\\\"PV-1: Define and establish secure configurations\\\",\\t\\\"PV-1\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"1.1\\\",\\t\\\"Azure Policy | Azure Blueprints\\\",\\r\\n\\\"PV-2: Audit and enforce secure configurations\\\",\\t\\\"PV-2\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PV-3: Define and establish secure configurations for compute resources\\\",\\t\\\"PV-3\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"PV-4: Audit and enforce secure configurations for compute resources\\\",\\t\\\"PV-4\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"4.1\\\",\\t\\\"CM-2 | CM-6\\\",\\t\\\"2.2\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"PV-5: Perform vulnerability assessments\\\",\\t\\\"PV-5\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"5.5 | 7.1 | 7.5 | 7.6\\\",\\t\\\"RA-3 | RA-5\\\",\\t\\\"6.1 | 6.2 | 6.6\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"PV-6: Rapidly and automatically remediate vulnerabilities\\\",\\t\\\"PV-6\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"7.2 | 7.3 | 7.4 | 7.7\\\",\\t\\\"RA-3 | RA-5 | SI-2\\\",\\t\\\"6.1 | 6.2 | 6.5 | 11.2\\\",\\t\\\"Microsoft Defender for Cloud | Azure Automation\\\",\\r\\n\\\"PV-7: Conduct regular red team operations\\\",\\t\\\"PV-7\\\",\\t\\\"Posture & Vulnerability Management\\\",\\t\\\"18.1 | 18.2 | 18.3 | 18.4 | 18.5\\\",\\t\\\"CA-8 | RA-5\\\",\\t\\\"6.6 | 11.2 | 11.3\\\",\\t\\\"Microsoft Sentinel | Microsoft 365 Compliance Manager\\\",\\r\\n\\\"ES-1: Use Endpoint Detection and Response (EDR)\\\",\\t\\\"ES-1\\\",\\t\\\"Endpoint Security\\\",\\t\\\"13.7\\\",\\t\\\"SC-3 | SI-2 | SI-3 | SI-16\\\",\\t\\\"11.5\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"ES-2: Use modern anti-malware software\\\",\\t\\\"ES-2\\\",\\t\\\"Endpoint Security\\\",\\t\\\"10.1\\\",\\t\\\"SC-3 | SI-2 | SI-3 | SI-16\\\",\\t\\\"5.1\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"ES-3: Ensure anti-malware software and signatures are updated\\\",\\t\\\"ES-3\\\",\\t\\\"Endpoint Security\\\",\\t\\\"10.2\\\",\\t\\\"SI-2 | SI-3\\\",\\t\\\"5.2\\\",\\t\\\"Microsoft Defender for Cloud | Microsoft Defender for Endpoint\\\",\\r\\n\\\"BR-1: Ensure regular automated backups\\\",\\t\\\"BR-1\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.2\\\",\\t\\\"CP-2 | CP-4 | CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Microsoft Defender for Cloud | Azure Backup\\\",\\r\\n\\\"BR-2: Protect backup and recovery data\\\",\\t\\\"BR-2\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.3\\\",\\t\\\"CP-6 | CP-9\\\",\\t\\\"3.4\\\",\\t\\\"Microsoft Defender for Cloud | Azure Backup\\\",\\r\\n\\\"BR-3: Monitor backups\\\",\\t\\\"BR-3\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.3\\\",\\t\\\"CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Azure Backup | Key Vault\\\",\\r\\n\\\"BR-4: Regularly test backups\\\",\\t\\\"BR-4\\\",\\t\\\"Backup & Recovery\\\",\\t\\\"11.5\\\",\\t\\\"CP-4 | CP-9\\\",\\t\\\"N/A\\\",\\t\\\"Azure Backup | Key Vault\\\",\\r\\n\\\"DS-1: Conduct Threat Modeling\\\",\\t\\\"DS-1\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.10 | 16.14\\\",\\t\\\"SA-15\\\",\\t\\\"6.5 | 12.2\\\",\\t\\\"Threat Modeling Tool | Microsoft Sentinel\\\",\\r\\n\\\"DS-2: Ensure Software Supply Chain Security\\\",\\t\\\"DS-2\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.4 | 16.6 | 16.11\\\",\\t\\\"SA-12 | SA-15\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Microsoft Defender for Cloud | GitHub\\\",\\r\\n\\\"DS-3: Secure DevOps Infrastructure\\\",\\t\\\"DS-3\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.7\\\",\\t\\\"CM-2 | CM-6 | AC-2 | AC-3 | AC-6\\\",\\t\\\"2.2 | 6.3 | 7.1\\\",\\t\\\"Microsoft Sentinel\\\",\\r\\n\\\"DS-4: Integrate Static Application Security Testing into DevOps Pipeline\\\",\\t\\\"DS-4\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.12\\\",\\t\\\"SA-11\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Credential Scanner | Binskim | CodeQL | GitHub: Secret Scanning\\\",\\r\\n\\\"DS-5: Integrate Dynamic Application Security Testing into DevOps Pipeline\\\",\\t\\\"DS-5\\\",\\t\\\"DevOps Security\\\",\\t\\\"16.12\\\",\\t\\\"SA-11\\\",\\t\\\"6.3 | 6.5\\\",\\t\\\"Azure DevOps | Azure Marketplace\\\",\\r\\n\\\"DS-6: Enforce Security of Workload throughout DevOps Lifecycle\\\",\\t\\\"DS-6\\\",\\t\\\"DevOps Security\\\",\\t\\\"7.5 | 7.6 | 7.7 | 16.1 | 16.7\\\",\\t\\\"CM-2 | CM-6 | AC-2 | AC-3 | AC-6\\\",\\t\\\"6.1 | 6.2 | 6.3\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"DS-7: Enable Logging and Monitoring in DevOps\\\",\\t\\\"DS-7\\\",\\t\\\"DevOps Security\\\",\\t\\\"8.2 | 8.5 | 8.9 | 8.11\\\",\\t\\\"AU-3 | AU-6 | AU-12 | SI-4\\\",\\t\\\"10.1 | 10.2 | 10.3 | 10.6\\\",\\t\\\"Microsoft Sentinel | GitHub | Azure DevOps\\\",\\r\\n\\\"GS-1: Align organization roles | responsibilities and accountabilities\\\",\\t\\\"GS-1\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"14.9\\\",\\t\\\"PL-9 | PM-10 | PM-13 | AT-1 | AT-3\\\",\\t\\\"2.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"GS-2: Define and implement enterprise segmentation/separation of duties strategy\\\",\\t\\\"GS-2\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"3.12\\\",\\t\\\"AC-4 | SC-7 | SC-2\\\",\\t\\\"1.2 | 6.4\\\",\\t\\\"Azure ExpressRoute | VPN Gateway | Azure Active Directory\\\",\\r\\n\\\"GS-3: Define and implement data protection strategy\\\",\\t\\\"GS-3\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"3.1 | 3.7 | 3.12\\\",\\t\\\"AC-4 | SI-4 | SC-8 | SC-12 | SC-17 | SC-28 | RA-2\\\",\\t\\\"3.1 | 3.2 | 3.3 | 3.4 | 3.5 | 3.6 | 3.7 | 4.1 | A3.2\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Information Protection | Microsoft Defender for Endpoint | Microsoft 365 Defender | Microsoft Defender for Office 365 | Microsoft Cloud App Security\\\",\\r\\n\\\"GS-4: Define and implement network security strategy\\\",\\t\\\"GS-4\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"12.2 | 12.4\\\",\\t\\\"AC-4 | AC-17 | CA-3 | CM-1 | CM-2 | CM-6 | CM-7 | SC-1 | SC-2 | SC-5 | SC-7 | SC-20 | SC-21 | SI-4\\\",\\t\\\"1.1 | 1.2 | 1.3 | 1.5 | 4.1 | 6.6 | 11.4 | A2.1 | A2.2 | A2.3 | A3.2\\\",\\t\\\"Virtual Network | Azure Firewall | Azure Web Application Firewall\\\",\\r\\n\\\"GS-5: Define and implement security posture management strategy\\\",\\t\\\"GS-5\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.1 | 4.2\\\",\\t\\\"CA-1 | CA-8 | CM-1 | CM-2 | CM-6 | RA-1 | RA-3 | RA-5 | SI-1 | SI-2 | SI-5\\\",\\t\\\"1.1 | 1.2 | 2.2 | 6.1 | 6.2 | 6.5 | 6.6 | 11.2 | 11.3 | 11.5\\\",\\t\\\"Microsoft Defender for Cloud\\\",\\r\\n\\\"GS-6: Define and implement identity and privileged access strategy\\\",\\t\\\"GS-6\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"5.6 | 6.5 | 6.7\\\",\\t\\\"AC-1 | AC-2 | AC-3 | AC-4 | AC-5 | AC-6 | IA-1 | IA-2 | IA-4 | IA-5 | IA-8 | IA-9 | SI-4\\\",\\t\\\"7.1 | 7.2 | 7.3 | 8.1 | 8.2 | 8.3 | 8.4 | 8.5 | 8.6 | 8.7 | 8.8 | A3.4\\\",\\t\\\"Azure Active Directory\\\",\\r\\n\\\"GS-7: Define and implement logging | threat detection and incident response strategy\\\",\\t\\\"GS-7\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"8.1 | 13.1 | 17.2 | 17.4 | 17.7\\\",\\t\\\"AU-1 | IR-1 | IR-2 | IR-10 | SI-1 | SI-5\\\",\\t\\\"10.1 | 10.2 | 10.3 | 10.4 | 10.5 | 10.6 | 10.7 | 10.8 | 10.9 | 12.10 | A3.5\\\",\\t\\\"Microsoft Sentinel | Microsoft Defender for Cloud | Azure Monitor\\\",\\r\\n\\\"GS-8: Define and implement backup and recovery strategy\\\",\\t\\\"GS-8\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"11.1\\\",\\t\\\"CP-1 | CP-9 | CP-10\\\",\\t\\\"3.4\\\",\\t\\\"Azure Backup\\\",\\r\\n\\\"GS-9: Define and implement endpoint security strategy\\\",\\t\\\"GS-9\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.4 | 10.1\\\",\\t\\\"SI-2 | SI-3 | SC-3\\\",\\t\\\"5.1 | 5.2 | 5.3 | 5.4 | 11.5\\\",\\t\\\"Microsoft Defender for Endpoint | Microsoft Defender for Cloud\\\",\\r\\n\\\"GS-10: Define and implement DevOps security strategy\\\",\\t\\\"GS-10\\\",\\t\\\"Governance & Strategy\\\",\\t\\\"4.1 | 4.2 | 16.1 | 16.2\\\",\\t\\\"SA-12 | SA-15 | CM-1 | CM-2 | CM-6 | AC-2 | AC-3 | AC-6 | SA-11 | AU-6 | AU-12 | SI-4\\\",\\t\\\"2.2 | 6.1 | 6.2 | 6.3 | 6.5 | 7.1 | 10.1 | 10.2 | 10.3 | 10.6 | 12.2\\\",\\t\\\"GitHub | Azure DevOps\\\"\\r\\n];\\r\\nCrosswalk\\r\\n| project [\\\"Control Name\\\"], [\\\"Control Area\\\"], [\\\"Recommended Products\\\"], [\\\"NIST SP 800-53 R4\\\"], [\\\"CIS v8\\\"],[\\\"PCI-DSS v3\\\"]\",\"size\":0,\"showAnalytics\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommended Products\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isCMAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Controls Mapping\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Network Security (NS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)\\r\\n---\\r\\n\\r\\nNetwork Security covers controls to secure and protect Azure networks, including securing virtual networks, establishing private connections, preventing and mitigating external attacks, and securing DNS. \"},\"customWidth\":\"40\",\"name\":\"NS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Establish Network Segmentation Boundaries (NS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure Cloud Services with Network Controls (NS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Firewall at the Edge of Enterprise Network (NS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Intrusion Prevention Systems (NS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy DDOS Protection (NS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5a3550b0-a5cc-40f2-8de4-c6eeb7613825\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"56667767-7bc7-482e-a9ee-a586388dea35\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"97d1ea2a-9b09-41d5-9cc1-1bbe5c450c63\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e3efe6ef-e4f9-4239-a56a-cb759f3232f7\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Deploy Web Application Firewall (NS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Simplify Network Security Configuration (NS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Detect and Disable Insecure Services and Protocols (NS-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Connect On-Premises or Cloud Network Privately (NS-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS9\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Domain Name System (DNS) Security (NS-10)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"NS10\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d73c278-b084-4ad5-a62c-34da79aeb1e4\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"632225ba-7633-4757-afac-3acd25aa16a7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"556013a1-3233-4222-805a-4d9e645908cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7910479a-d93a-4529-a520-3a9ee2cd797b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"60660fc5-6d89-41e1-926b-feb8390baf2c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isNS10Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"NS10\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Establish Network Segmentation Boundaries (NS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-1-establish-network-segmentation-boundaries)\\r\\n\\r\\nEnsure that your virtual network deployment aligns to your enterprise segmentation strategy defined in the GS-2 security control. Any workload that could incur higher risk for the organization should be in isolated virtual networks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Virtual Network concepts and best practices](https://docs.microsoft.com/azure/virtual-network/concepts-and-best-practices)
\\r\\n💡 [Add, change, or delete a virtual network subnet](https://docs.microsoft.com/azure/virtual-network/virtual-network-manage-subnet)
\\r\\n💡 [How to create a network security group with security rules](https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic)
\\r\\n💡 [Understand and use application security groups](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview#application-security-groups)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n🔀 [Application Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FapplicationSecurityGroups)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"securitygroups\\\" or type contains \\\"network\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Assets & Infrastructure\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where Category == \\\"NetworkSecurityGroupRuleCounter\\\"\\r\\n| summarize\\r\\n Deny = countif(type_s == \\\"block\\\"),\\r\\n Allow = countif(type_s == \\\"allow\\\"),\\r\\n Total = countif(type_s == \\\"allow\\\" or type_s == \\\"block\\\")\\r\\n by ruleName_s, ResourceId\\r\\n| project RuleName=ruleName_s, ResourceId, Total, Allow, Deny\\r\\n| sort by Total desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Security Group Rules by Action Count\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RuleName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"BlankDashboard\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Allow\",\"color\":\"green\"},{\"columnName\":\"Deny\",\"color\":\"redBright\"}]}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isNS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure Cloud Services with Network Controls (NS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-2-secure-cloud-services-with-network-controls)\\r\\n\\r\\nSecure cloud services by establishing a private access point for the resources. You should also disable or restrict access from public network when possible.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Private Link](https://azure.microsoft.com/services/private-link/) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Azure Private Link](https://docs.microsoft.com/azure/private-link/private-link-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Private Link](https://portal.azure.com/#blade/Microsoft_Azure_Network/PrivateLinkCenterBlade/overview)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"private\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Private Links\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Private Links\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Firewall at Edge of Enterprise Network (NS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-3-deploy-firewall-at-the-edge-of-enterprise-network)\\r\\n\\r\\nDeploy a firewall to perform advanced filtering on network traffic to and from external networks. You can also use firewalls between internal segments to support a segmentation strategy. If required, use custom routes for your subnet to override the system route when you need to force the network traffic to go through a network appliance for security control purpose.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to deploy Azure Firewall](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\\r\\n💡 [Virtual network traffic routing](https://docs.microsoft.com/azure/virtual-network/virtual-networks-udr-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"firewall\\\" and type !contains \\\"web\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Firewalls\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Firewalls\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//reference list posted here : https://docs.microsoft.com/azure/data-explorer/kusto/query/ipv4-lookup-plugin\\r\\nlet geoData = externaldata\\r\\n(network:string,geoname_id:string,continent_code:string,continent_name:string,\\r\\ncountry_iso_code:string,country_name:string,is_anonymous_proxy:string,is_satellite_provider:string)\\r\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"] with (ignoreFirstRecord=true, format=\\\"csv\\\");\\r\\nlet materializedData =\\r\\n(\\r\\nAzureDiagnostics\\r\\n| where Category == \\\"AzureFirewallNetworkRule\\\"\\r\\n| where OperationName <> \\\"AzureFirewallThreatIntelLog\\\"\\r\\n| where OperationName <> \\\"AzureFirewallIDSLog\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n| project msg_s, Resource, TimeGenerated,ResourceId , ResourceGroup , SubscriptionId);\\r\\nunion\\r\\n(\\r\\n// Azure Firewall Networking - Standard Log\\r\\nmaterializedData\\r\\n| where msg_s !has \\\"Type=\\\" and msg_s !has \\\"DNAT'ed\\\" and msg_s !has \\\"Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking with ICMP\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Type=\\\"\\r\\n| parse msg_s with Protocol \\\" Type=\\\" ICMPType \\\" request from \\\" SourceIP \\\" to \\\" DestinationIP \\\". Action: \\\" Action\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule - Standard\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s !has \\\". Rule Collection:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule (firewall not using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s has \\\". Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination \\\". Rule Collection: \\\" RuleCollection \\\". Rule: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Networking DNAT rule (firewall using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"DNAT'ed\\\" and msg_s has \\\". Rule Collection:\\\" and msg_s has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\" was \\\" Action \\\" to \\\" NatDestination \\\". Policy: \\\" Policy \\\". Rule Collection Group:\\\" RuleCollectionGroup \\\". Rule Collection: \\\" RuleCollection \\\". Rule: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Network rule (firewall not using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Rule Collection:\\\" and msg_s !has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Rule Collection: \\\" RuleCollection \\\". Rule Name: \\\" Rule\\r\\n),\\r\\n(\\r\\n// Azure Firewall Network rule (firewall using policy)\\r\\nmaterializedData\\r\\n| where msg_s has \\\"Policy:\\\"\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestinationIP \\\":\\\" DestinationPort \\\". Action: \\\" Action \\\". Policy:\\\" Policy \\\". Rule Collection Group:\\\" RuleCollectionGroup \\\". Rule Collection: \\\" RuleCollection \\\". Rule Name: \\\" Rule\\r\\n)\\r\\n| summarize by TimeGenerated,Protocol, ICMPType, Action,SourceIP, SourcePort, DestinationIP , DestinationPort , NatDestination, ResourceId , ResourceGroup , SubscriptionId\\r\\n| evaluate ipv4_lookup (geoData, DestinationIP, network, false)\\r\\n| project ResourceId, Action, Protocol, SourceIP, SourcePort, DestinationIP, DestinationPort, country_name,TimeGenerated \\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Azure Firewall Traffic\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"contains\",\"thresholdValue\":\"Allow\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"contains\",\"thresholdValue\":\"Deny\",\"representation\":\"4\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"1\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RuleName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"BlankDashboard\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Allow\",\"color\":\"green\"},{\"columnName\":\"Deny\",\"color\":\"redBright\"}]}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Intrusion Prevention Systems (NS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-4-deploy-intrusion-detectionintrusion-prevention-systems-idsips)\\r\\n\\r\\nUse network intrusion detection and intrusion prevention systems (IDS/IPS) to inspect the network and payload traffic to or from your workload. Ensure that IDS/IPS is always tuned to provide high-quality alerts to your SIEM solution.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Firewall IDPS](https://docs.microsoft.com/azure/firewall/premium-features#idps)
\\r\\n💡 [Microsoft Defender for Endpoint capability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceType == \\\"AZUREFIREWALLS\\\"\\r\\n| where OperationName == \\\"AzureFirewallIDSLog\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n| parse msg_s with Protocol \\\" request from \\\" SourceIP \\\":\\\" SourcePort \\\" to \\\" DestIP \\\":\\\" DestPort \\\". Action: \\\" Action \\\". Signature: \\\" SignatureID \\\". IDS:\\\" Message \\\". Priority:\\\" Priority \\\". Classification:\\\" Classification\\r\\n| extend IPS_Policy=strcat(\\\"IPS_Policy\\\")\\r\\n| project Action, IPS_Policy, SignatureID, Message, Protocol, SourceIP, SourcePort, DestIP, DestPort, TimeGenerated\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Intrusion Prevention Actions (Azure Firewall)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Action\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IPS_Policy\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"IPS Policy >>\",\"bladeOpenContext\":{\"bladeName\":\"FirewallManagerMenuBlade\",\"extensionName\":\"Microsoft_Azure_HybridNetworking\"}}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"intrusion\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Intrusions\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy DDoS Protection (NS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-5-deploy-ddos-protection)\\r\\n\\r\\nDeploy distributed denial of service (DDoS) protection to protect your network and applications from attacks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/AzureDiagnostics) ✳️ [Azure DDoS Protection](https://azure.microsoft.com/services/ddos-protection/)
🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Manage Azure DDoS Protection Standard using the Azure portal](https://docs.microsoft.com/azure/virtual-network/manage-ddos-protection)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"dos\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Azure DDoS Plans\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"dos\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: DDoS\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Deploy Web Application Firewall (NS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-6-deploy-web-application-firewall)\\r\\n\\r\\nDeploy a web application firewall (WAF) and configure the appropriate rules to protect your web applications and APIs from application-specific attacks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter)🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to deploy Azure WAF](https://docs.microsoft.com/azure/web-application-firewall/overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Web Application Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies)
\"},\"name\":\"NS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"webapplicationfirewall\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Web Application Firewalls\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"WAF\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: WAF\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Simplify Network Security Configuration (NS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-7-simplify-network-security-configuration)\\r\\n\\r\\nWhen managing a complex network environment, use tools to simplify, centralize and enhance the network security management.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Adaptive Network Hardening in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-adaptive-network-hardening)
\\r\\n💡 [Azure Firewall Manager](https://docs.microsoft.com/azure/firewall-manager/overview)
\\r\\n💡 [Create an Azure Firewall and a firewall policy - ARM template](https://docs.microsoft.com/azure/firewall-manager/quick-firewall-policy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detect & Disable Insecure Services & Protocols (NS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-8-detect-and-disable-insecure-services-and--protocols)\\r\\n\\r\\nDetect and disable insecure services and protocols at the OS, application, or software package layer. Deploy compensating controls if disabling insecure services and protocols are not possible.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [SecurityEvent](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Sentinel insecure protocols workbook](https://docs.microsoft.com/azure/sentinel/quickstart-get-visibility#use-built-in-workbooks)
\\r\\n💡 [Conditional Access: Block legacy authentication](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-policy-block-legacy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Entra ID: Conditional Access](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ConditionalAccessBlade/Policies)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.8\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let scEvents = dynamic([5827, 5828, 5829, 5830, 5831]);\\r\\nlet legacyAuth = SigninLogs\\r\\n| where ResultType == 0\\r\\n| where ClientAppUsed !contains \\\"Browser\\\" and ClientAppUsed !contains \\\"Mobile Apps and Desktop clients\\\"\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), Protocol=\\\"AAD Legacy Auth\\\";\\r\\nSecurityEvent\\r\\n| parse EventData with * '\\\"TicketEncryptionType\\\">' TicketEncryptionType '<' *\\r\\n| union Event\\r\\n| where (EventID == 2889) or (EventID == 3000 and EventLog == 'Microsoft-Windows-SMBServer/Audit') or (EventID == 4624 and AuthenticationPackageName == 'NTLM' and LmPackageName == 'NTLM V1' and Account !contains 'ANONYMOUS LOGON') or ((EventID == 4624 or EventID == 4776) and Level == 8 and PackageName contains 'WDigest') or (EventID == 4768 or EventID == 4769) and Level == 8 and (TicketEncryptionType != \\\"0x12\\\" and TicketEncryptionType != \\\"0x11\\\") or ((EventLog =~ \\\"System\\\" and Source =~ \\\"NETLOGON\\\") and EventID in (scEvents))\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), tostring(EventID)\\r\\n//| extend Protocol=replace(tostring(4776), 'WDigest', replace(tostring(4768), 'Kerberos weak cipher', replace(tostring(4769), 'Kerberos weak cipher', replace(tostring(2889), 'Insecure LDAP', replace(tostring(4624), 'NTLM v1', replace(tostring(3000), 'SMB v1', tostring(EventID)))))))\\r\\n| extend Protocol = case(EventID == 4776, \\\"WDigest\\\", EventID == 4768 or EventID == 4769, \\\"Weak Kerberos Cipher\\\", EventID == 2889, \\\"Insecure LDAP\\\", EventID == 4624, \\\"NTLM v1\\\", EventID == 3000, \\\"SMBv1\\\", EventID in (scEvents), \\\"Vulnerable Secure Channel\\\", \\\"Unknown\\\")\\r\\n| project Protocol, Count, TimeGenerated\\r\\n| union legacyAuth\\r\\n| sort by Count desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Insecure Protocols Count over Time (Microsoft Entra ID)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-S\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Passed\",\"color\":\"green\"},{\"seriesName\":\"Failed\",\"color\":\"redBright\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let scEvents = dynamic([5827, 5828, 5829, 5830, 5831]);\\r\\nlet legacyAuth = SigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| where ClientAppUsed !contains \\\"Browser\\\" and ClientAppUsed !contains \\\"Mobile Apps and Desktop clients\\\"\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), Protocol=\\\"AAD Legacy Auth\\\", UserPrincipalName, UserProfile, UserId;\\r\\nSecurityEvent\\r\\n| parse EventData with * '\\\"TicketEncryptionType\\\">' TicketEncryptionType '<' *\\r\\n| union Event\\r\\n| where (EventID == 2889) or (EventID == 3000 and EventLog == 'Microsoft-Windows-SMBServer/Audit') or (EventID == 4624 and AuthenticationPackageName == 'NTLM' and LmPackageName == 'NTLM V1' and Account !contains 'ANONYMOUS LOGON') or ((EventID == 4624 or EventID == 4776) and Level == 8 and PackageName contains 'WDigest') or (EventID == 4768 or EventID == 4769) and Level == 8 and (TicketEncryptionType != \\\"0x12\\\" and TicketEncryptionType != \\\"0x11\\\") or ((EventLog =~ \\\"System\\\" and Source =~ \\\"NETLOGON\\\") and EventID in (scEvents))\\r\\n| summarize Count=count() by bin(TimeGenerated, {TimeRange:grain}), tostring(EventID), Account\\r\\n//| extend Protocol=replace(tostring(4776), 'WDigest', replace(tostring(4768), 'Kerberos weak cipher', replace(tostring(4769), 'Kerberos weak cipher', replace(tostring(2889), 'Insecure LDAP', replace(tostring(4624), 'NTLM v1', replace(tostring(3000), 'SMB v1', tostring(EventID)))))))\\r\\n| extend Protocol = case(EventID == 4776, \\\"WDigest\\\", EventID == 4768 or EventID == 4769, \\\"Weak Kerberos Cipher\\\", EventID == 2889, \\\"Insecure LDAP\\\", EventID == 4624, \\\"NTLM v1\\\", EventID == 3000, \\\"SMBv1\\\", EventID in (scEvents), \\\"Vulnerable Secure Channel\\\", \\\"Unknown\\\")\\r\\n| project Protocol, Count, Account, TimeGenerated\\r\\n| union legacyAuth\\r\\n| sort by Count desc\\r\\n| project Protocol, Count, UserPrincipalName, UserProfile, LastObserved=TimeGenerated, Account, UserId\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Insecure Protocol Details\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Protocol\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Connect On-Premises & Cloud Privately (NS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-9-connect-on-premises-or-cloud-network-privately)\\r\\n\\r\\nUse private connections for secure communication between different networks, such as cloud service provider data centers and on-premises infrastructure in a co-location environment.\\r\\n\\r\\n## Recommended Logs \\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/) ✳️ [Azure ExpressRoute](https://azure.microsoft.com/services/expressroute/) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure VPN overview](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways)
\\r\\n💡 [What are the ExpressRoute connectivity models](https://docs.microsoft.com/azure/expressroute/expressroute-connectivity-models)
\\r\\n💡 [Virtual network peering](https://docs.microsoft.com/azure/virtual-network/virtual-network-peering-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
\\r\\n🔀 [ExpressRoute](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits)
\\r\\n🔀 [Peerings](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Peering%2Fpeerings)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"express\\\" or type contains \\\"gateway\\\" or type contains \\\"peer\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Gateways, ExpressRoutes, Peerings\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Rule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isNS9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Domain Name System Security (NS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security#ns-10-ensure-domain-name-system-dns-security)\\r\\n\\r\\nEnsure that Domain Name System (DNS) security configuration protects against known risks.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DNS](https://azure.microsoft.com/services/dns/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure DNS overview](https://docs.microsoft.com/azure/dns/dns-overview)
\\r\\n💡 [Secure Domain Name System (DNS) Deployment Guide](https://csrc.nist.gov/publications/detail/sp/800-81/2/final)
\\r\\n💡 [Azure Private DNS](https://docs.microsoft.com/azure/dns/private-dns-overview)
\\r\\n💡 [Azure Defender for DNS](https://docs.microsoft.com/azure/security-center/defender-for-dns-introduction)
\\r\\n💡 [Prevent dangling DNS entries and avoid subdomain takeover](https://docs.microsoft.com/azure/security/fundamentals/subdomain-takeover)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
\\r\\n🔀 [Private DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FprivateDnsZones)
\"},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"NS.10\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"dns\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" DNS Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"dns\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: DNS\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isNS10Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"NS-10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isNSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Network Security (NS)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Identity Management (IM)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management) \\r\\n---\\r\\n\\r\\nIdentity Management covers controls to establish a secure identity and access controls using Microsoft Entra ID, including the use of single sign-on, strong authentications, managed identities (and service principles) for applications, conditional access, and account anomalies monitoring. \"},\"customWidth\":\"40\",\"name\":\"IM Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Centralized Identity & Authentication (IM-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Protect Identity & Authentication Systems (IM-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Manage App Identities Securely (IM-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Authenticate Server & Services (IM-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use SSO for App Access (IM-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"7e34d95b-a1fd-4326-a960-8c43a4afd9b4\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"85eac3da-ccbd-43cc-a9b3-cb41490ff565\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"7b658bf7-dbbc-4a85-90e4-4998bb428a38\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"271668c4-6655-43cd-ac75-2f1683932d4d\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Strong Authentication Controls (IM-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Restrict Resource Access Based on Conditions (IM-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Restrict the Exposure of Credentials & Secrets (IM-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure User Access to Existing Apps (IM-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IM9\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5a3550b0-a5cc-40f2-8de4-c6eeb7613825\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"28277e0e-d51f-40a6-8552-2fbd5fe38fcf\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"53ff2b19-b478-4ebf-a112-82ef29db7fb9\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIM9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IM9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5b8d7037-4b7e-478a-a98e-73a24229c90d\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Centralized Identity & Authentication (IM-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-1-use-centralized-identity-and-authentication-system)\\r\\n\\r\\nUse a centralized identity and authentication system to govern your organization's identities and authentications for cloud and non-cloud resources.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID]( https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Tenancy in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/develop/single-and-multi-tenant-apps)
\\r\\n💡 [How to Create and Configure an Microsoft Entra ID Instance](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-access-create-new-tenant)
\\r\\n💡 [Define Microsoft Entra ID Tenants](https://azure.microsoft.com/resources/securing-azure-environments-with-azure-active-directory/)
\\r\\n💡 [Use External Identity Providers for An Application](https://docs.microsoft.com/azure/active-directory/external-identities/identity-providers)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = SigninLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastSignIn=TimeGenerated;\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, UserProfile, LastSignIn, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Review Valid Accounts\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Protect Identity & Authentication Systems (IM-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management?WT.mc_id=Portal-fx#im-2-protect-identity-and-authentication-systems)\\r\\n\\r\\nSecure your identity and authentication system as a high priority in your organization's cloud security practice.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n🔷 [AADUserRiskEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aaduserriskevents) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What is the identity secure score in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/fundamentals/identity-secure-score)
\\r\\n💡 [Best Practices for Securing Active Directory](https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Microsoft Sentinel](https://ms.portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"name\":\"IM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Tactics contains \\\"access\\\" or Tactics contains \\\"elevate\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Identity \",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AADUserRiskEvents \\r\\n| extend RiskyUsers = strcat(\\\"https://ms.portal.azure.com/#blade/Microsoft_AAD_IAM/RiskyUsersBlade\\\")\\r\\n| summarize count() by UserPrincipalName, RiskLevel, RiskyUsers\\r\\n| extend Rank=iff(RiskLevel == \\\"high\\\", 3, iff(RiskLevel == \\\"medium\\\", 2, iff(RiskLevel == \\\"low\\\", 1, 0)))\\r\\n| where UserPrincipalName <> \\\"\\\"\\r\\n| project UserPrincipalName, RiskLevel, RiskyUsers, count_, Rank\\r\\n| sort by Rank,count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Risky Users\",\"noDataMessage\":\"Confirm Microsoft Defender for Cloud SecurityRecommendation logging is enabled and/or extend time thresholds for a larger data-set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RiskLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"high\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RiskyUsers\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Risky User Response >>\",\"bladeOpenContext\":{\"bladeName\":\"RiskyUsersBlade\",\"extensionName\":\"Microsoft_AAD_IAM\"}}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Rank\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Manage Application Identities Securely (IM-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-3-manage-application-identities-securely-and-automatically)\\r\\n\\r\\nUse managed application identities instead of creating human accounts for applications to access resources and execute code. Managed application identities provide benefits such as reducing the exposure of credentials. Automate the rotation of credential to ensure the security of the identities.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AADManagedIdentitySignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadmanagedidentitysigninlogs) 🔷 [AADServicePrincipalSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Managed Identities](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/overview)
\\r\\n💡 [Services that Support Managed Identities for Azure Resources](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/services-support-managed-identities)
\\r\\n💡 [Azure Service Principal](https://docs.microsoft.com/powershell/azure/create-azure-service-principal-azureps)
\\r\\n💡 [Create a Service Principal with Certificates](https://docs.microsoft.com/azure/active-directory/develop/howto-authenticate-service-principal-powershell)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Managed Identities](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.ManagedIdentity%2FuserAssignedIdentities)
\\r\\n🔀 [App Registrations](https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADManagedIdentitySignInLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by ServicePrincipalName\\r\\n| project ServicePrincipalName, LastSignIn=TimeGenerated;\\r\\nAADManagedIdentitySignInLogs\\r\\n| extend ManagedIdentities = strcat(\\\"Managed Identities\\\")\\r\\n| where ResultType == 0\\r\\n| summarize count() by ServicePrincipalName, ManagedIdentities\\r\\n| join (LastObserved) on ServicePrincipalName\\r\\n| project ServicePrincipalName, SignInCount=count_, ManagedIdentities, LastSignIn\\r\\n| sort by SignInCount desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Managed Identity Actions\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ServicePrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ManagedIdentities\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Managed Identities >>\",\"bladeOpenContext\":{\"bladeName\":\"BrowseResource\",\"extensionName\":\"HubsExtension\",\"bladeParameters\":[{\"name\":\"resourceType\",\"source\":\"static\",\"value\":\"Microsoft.ManagedIdentity/userAssignedIdentities\"}]}}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADServicePrincipalSignInLogs \\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by ServicePrincipalName\\r\\n| project ServicePrincipalName, LastSignIn=TimeGenerated;\\r\\nAADServicePrincipalSignInLogs \\r\\n| extend ServicePrincipals = strcat(\\\"Service Principals\\\")\\r\\n| where ResultType == 0\\r\\n| summarize count() by ServicePrincipalName, ServicePrincipals\\r\\n| join (LastObserved) on ServicePrincipalName\\r\\n| project ServicePrincipalName, SignInCount=count_, ServicePrincipals, LastSignIn\\r\\n| sort by SignInCount desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Service Principal Actions\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ServicePrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"green\"}},{\"columnMatch\":\"ServicePrincipals\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Service Principals >>\",\"bladeOpenContext\":{\"bladeName\":\"ActiveDirectoryMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\"}}},{\"columnMatch\":\"ManagedIdentities\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Managed Identities >>\",\"bladeOpenContext\":{\"bladeName\":\"BrowseResource\",\"extensionName\":\"HubsExtension\",\"bladeParameters\":[{\"name\":\"resourceType\",\"source\":\"static\",\"value\":\"Microsoft.ManagedIdentity/userAssignedIdentities\"}]}}},{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Authenticate Server and Services (IM-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-4-authenticate-server-and-services)\\r\\n\\r\\nAuthenticate remote servers and services from your client side to ensure you are connecting to trusted server and services. The most common server authentication protocol is Transport Layer Security (TLS), where the client-side (often a browser or client device) verifies the server by verifying the server’s certificate was issued by a trusted certificate authority. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Enforce Transport Layer Security (TLS) for a storage account](https://docs.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal#use-azure-policy-to-enforce-the-minimum-tls-version)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| where RecommendationName contains \\\"TLS\\\" or RecommendationName contains \\\"Auth\\\" or RecommendationName contains \\\"JIT\\\" or RecommendationName contains \\\"access\\\"\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Single Sign-on (SSO) for Application Access (IM-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-5-use-single-sign-on-sso-for-application-access)\\r\\n\\r\\nUse single sign-on (SSO) to simplify the user experience for authenticating to resources including applications and data across cloud services and on-premises environments. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AADNonInteractiveUserSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Application SSO with Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/manage-apps/what-is-single-sign-on)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = AADNonInteractiveUserSignInLogs\\r\\n| where ResultType == 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastSignIn=TimeGenerated;\\r\\nAADNonInteractiveUserSignInLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, UserProfile, LastSignIn, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"SSO Activity by Non-Interactive Sign-ins\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Strong Authentication Controls (IM-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-6-use-strong-authentication-controls)\\r\\n\\r\\nEnforce strong authentication controls (strong password-less authentication or multi-factor authentication) with your centralized identity and authentication management system for all access to resources. Authentication based on password credentials alone is considered legacy, as it is insecure and does not stand up to popular attack methods.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable MFA in Azure](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted)
\\r\\n💡 [Introduction to Password-less Authentication Options for Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless)
\\r\\n💡 [Microsoft Entra ID Default Password Policy](https://docs.microsoft.com/azure/active-directory/authentication/concept-sspr-policy#password-policies-that-only-apply-to-cloud-user-accounts)
\\r\\n💡 [Eliminate Bad Passwords Using Microsoft Entra ID Password Protection](https://docs.microsoft.com/azure/active-directory/authentication/concept-password-ban-bad)
\\r\\n💡 [Block legacy authentication](https://docs.microsoft.com/azure/active-directory/conditional-access/block-legacy-authentication)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IM.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MFAFailures = SigninLogs\\r\\n| where AuthenticationRequirement == \\\"multiFactorAuthentication\\\"\\r\\n| where ResultType <> 0\\r\\n| extend FailureReason = tostring(Status.failureReason)\\r\\n| where FailureReason contains \\\"User did not pass the MFA\\\"\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| summarize count() by UserPrincipalName, UserId, UserProfile\\r\\n| extend FailedMFACount=count_;\\r\\nlet LastObserved = SigninLogs\\r\\n| where ResultType <> 0\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastFailedSignIn=TimeGenerated;\\r\\nSigninLogs\\r\\n| where AuthenticationRequirement == \\\"multiFactorAuthentication\\\"\\r\\n| where ResultType <> 0\\r\\n| extend FailureReason = tostring(Status.failureReason)\\r\\n| where FailureReason contains \\\"User did not pass the MFA\\\"\\r\\n| make-series Trend = dcount(FailureReason) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by UserPrincipalName\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| join (MFAFailures) on UserPrincipalName\\r\\n| project UserPrincipalName, UserProfile, FailedMFACount, Trend, LastFailedSignIn, UserId\\r\\n| sort by FailedMFACount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Monitor User MFA Failures\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"FailedMFACount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"UserId\",\"formatter\":5}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Restrict Resource Access Based on Conditions (IM-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-7-restrict-resource-access-based-on--conditions)\\r\\n\\r\\nExplicitly validate trusted signals to allow or deny user access to resources, as part of a zero-trust access model. Signals to validate should include strong authentication of user account, behavioral analytics of user account, device trustworthiness, user or group membership, locations and so on.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Conditional Access Overview](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\\r\\n💡 [Common Conditional Access Policies](https://docs.microsoft.com/azure/active-directory/conditional-access/concept-conditional-access-policy-common)
\\r\\n💡 [Conditional Access insights and reporting](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-insights-reporting)
\\r\\n💡 [Configure Authentication Session Management with Conditional Access](https://docs.microsoft.com/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra Id](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let nonInteractive = AADNonInteractiveUserSignInLogs\\r\\n| extend LocationDetails = parse_json(LocationDetails)\\r\\n| extend Status = parse_json(Status)\\r\\n| extend ConditionalAccessPolicies = parse_json(ConditionalAccessPolicies);\\r\\nlet data = \\r\\nunion SigninLogs,nonInteractive\\r\\n|extend CAStatus = case(ConditionalAccessStatus ==\\\"success\\\",\\\"Successful\\\",\\r\\n ConditionalAccessStatus == \\\"failure\\\", \\\"Failed\\\", \\r\\n ConditionalAccessStatus == \\\"notApplied\\\", \\\"Not applied\\\", \\r\\n isempty(ConditionalAccessStatus), \\\"Not applied\\\", \\r\\n \\\"Disabled\\\")\\r\\n|mvexpand ConditionalAccessPolicies\\r\\n|extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\\r\\n|extend CAGrantControl = case(CAGrantControlName contains \\\"MFA\\\", \\\"Require MFA\\\", \\r\\n CAGrantControlName contains \\\"Terms of Use\\\", \\\"Require Terms of Use\\\", \\r\\n CAGrantControlName contains \\\"Privacy\\\", \\\"Require Privacy Statement\\\", \\r\\n CAGrantControlName contains \\\"Device\\\", \\\"Require Device Compliant\\\", \\r\\n CAGrantControlName contains \\\"Azure AD Joined\\\", \\\"Require Hybrid Azure AD Joined Device\\\", \\r\\n CAGrantControlName contains \\\"Apps\\\", \\\"Require Approved Apps\\\",\\r\\n \\\"Other\\\");\\r\\ndata\\r\\n| summarize Count = dcount(Id) by CAStatus\\r\\n| join kind = inner (data\\r\\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by CAStatus\\r\\n ) on CAStatus\\r\\n| project-away CAStatus1, TimeGenerated\\r\\n| order by Count desc\",\"size\":4,\"showAnalytics\":true,\"title\":\" Conditional Access Status \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"CAStatus\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"Category\"},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SigninLogs\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by ConditionalAccessStatus\\r\\n| render areachart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Conditional Access Status over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"notApplied\",\"color\":\"red\"},{\"seriesName\":\"success\",\"color\":\"greenDark\"}]}},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Restrict Exposure of Credentials & Secrets (IM-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-8-restrict-the-exposure-of-credential-and-secrets)\\r\\n\\r\\nEnsure that application developers securely handle credentials and secrets\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Setup Credential Scanner](https://secdevtools.azurewebsites.net/helpcredscan.html)
\\r\\n💡 [GitHub Secret Scanning](https://docs.github.com/github/administering-a-repository/about-secret-scanning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityAlert\\r\\n| where AlertName contains \\\"secret\\\" or AlertName contains \\\"cred\\\" or AlertName contains \\\"password\\\" or AlertName contains \\\"auth\\\" or AlertName contains \\\"cert\\\"\\r\\n| summarize count() by AlertName\\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Security Alerts for Credentials \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"secret\\\" or Title contains \\\"cred\\\" or Title contains \\\"password\\\" or Title contains \\\"auth\\\" or Title contains \\\"cert\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Secrets & Credentials\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure User Access to Existing Applications (IM-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management#im-9-secure-user-access-to--existing-applications)\\r\\n\\r\\nIn a hybrid environment, where you have on-premises applications or non-native cloud applications using legacy authentication, consider solutions such as cloud access security broker (CASB), application proxy, single sign-on (SSO) to govern the access to these applications. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Entra ID Application Proxy](https://learn.microsoft.com/en-us/entra/identity/app-proxy/overview-what-is-app-proxy)
\\r\\n💡 [Microsoft Defender for Cloud Apps Best Practices](https://docs.microsoft.com/cloud-app-security/best-practices)
\\r\\n💡 [Microsoft Entra ID secure hybrid access](https://docs.microsoft.com/azure/active-directory/manage-apps/secure-hybrid-access)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"app\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Applications\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIM9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IM-9\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Identity Management (IM)\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Identity Management (IM)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Privileged Access (PA)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access) \\r\\n---\\r\\nPrivileged Access covers controls to protect privileged access to your Azure tenant and resources, including a range of controls to protect your administrative model, administrative accounts, and privileged access workstations against deliberate and inadvertent risk. \"},\"customWidth\":\"40\",\"name\":\"PA Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Separate & Limit Highly Privileged Users (PA-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Avoid Standing Access for Accounts (PA-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Manage Lifecycle of Identities & Entitlements (PA-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Review User Access Regularly (PA-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"dbe2ebfe-02aa-4e6c-bd33-d134fe277f73\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"8e735a1c-34be-4429-a6d5-ea7754b5450d\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"8138f796-7f6a-45c4-acb3-40be84faf4d3\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Setup Emergency Access (PA-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Privileged Access Workstations (PA-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Follow Just Enough Administration Principle (PA-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Determine Access Process for Support (PA-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PA8\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f359d341-8d40-4cfb-8275-ad22d8424aa2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9d3bb081-76b4-48c9-a8bf-12fef2889550\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"184c2260-e070-4898-8a28-53695c294fe4\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPA8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PA8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6cc54ea3-a296-4221-ba1a-5999de049ca2\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Separate & Limit Highly Privileged Users (PA-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-1-separate-and-limit-highly-privilegedadministrative-users)\\r\\n\\r\\nEnsure you are identifying all high business impact accounts. Limit the number of privileged/administrative accounts in your cloud's control plane, management plane and data/workload plane. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Administrator Role Permissions in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/permissions-reference)
\\r\\n💡 [Use Azure Privileged Identity Management Security Alerts](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-how-to-configure-security-alerts)
\\r\\n💡 [Securing Privileged Access for Hybrid and Cloud Deployments in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/security-planning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Privileged Identity Management](https://ms.portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\"},\"name\":\"PA-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AuditLogs\\r\\n| where OperationName contains \\\"PIM\\\"\\r\\n| extend PIM = strcat(\\\"https://ms.portal.azure.com/#blade/Microsoft_Azure_PIMCommon/MyAuditsMenuBlade/aadmigratedroles\\\")\\r\\n| distinct OperationName, PIM, Identity, AADOperationType, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Privileged Identity Management (PIM) Elevations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"pending\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"PIM\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"PIM >>\",\"linkIsContextBlade\":false,\"bladeOpenContext\":{\"bladeName\":\"MyAuditsMenuBlade\",\"extensionName\":\"Microsoft_Azure_PIMCommon\"}}},{\"columnMatch\":\"Identity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"GrantedTo\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go To: Entra ID Profile >\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Avoid Standing Access for Accounts (PA-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-2-avoid-standing-access-for-user-accounts-and-permissions)\\r\\n\\r\\nInstead of creating standing privileges, use just-in-time (JIT) mechanism to assign privileged access to the different resource tiers.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure PIM just-in-time access deployment](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-deployment-plan)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Manage Lifecycle of Identities & Entitlements (PA-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-3-manage-lifecycle-of-identities-and-entitlements)\\r\\n\\r\\nUse an automated process or technical control to manage the identity and access lifecycle including the request, review, approval, provision, and deprovision.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What are Microsoft Entra ID access reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n💡 [What is Microsoft Entra ID entitlement management](https://docs.microsoft.com/azure/active-directory/governance/entitlement-management-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\\r\\n🔀 [Identity Governance](https://ms.portal.azure.com/#blade/Microsoft_AAD_ERM/DashboardBlade/GettingStarted)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Roles = IdentityInfo\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName=AccountUPN\\r\\n| project UserPrincipalName, AssignedRoles=strcat(AssignedRoles), GroupMemberships=strcat(GroupMembership);\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (Roles) on UserPrincipalName\\r\\n| project UserPrincipalName, UserProfile, AssignedRoles, GroupMemberships, UserId\\r\\n| sort by UserPrincipalName asc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Review User Roles and Groups\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"LastSignIn\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"SignInsBeforeInactive\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":2500,\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Review & Reconcile User Access Regularly (PA-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-4-review-and-reconcile-user-access-regularly)\\r\\n\\r\\nConduct regular review of privileged account entitlements. Ensure the access granted to the accounts is valid for administration of control plane, management plane, and workloads.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Create an access review of Azure resource roles in Privileged Identity Management (PIM)](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-resource-roles-start-access-review)
\\r\\n💡 [How to use Microsoft Entra ID identity and access reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n\\r\\n### Microsoft Portal\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"Account\\\" or Title contains \\\"User\\\" or Title contains \\\"Identity\\\" or Title contains \\\"Login\\\" or Title contains \\\"Sign\\\" or Title contains \\\"travel\\\" or Title contains \\\"impersonate\\\" or Title contains \\\"AAD\\\" or Title contains \\\"service principal\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: User Access\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Setup Emergency Access (PA-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-5-set-up-emergency-access)\\r\\n\\r\\nSet up emergency access to ensure that you are not accidentally locked out of your critical cloud infrastructure (such as your identity and access management system) in an emergency.\\r\\n\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Manage Emergency Access Accounts in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/roles/security-emergency-access)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Roles = IdentityInfo\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName=AccountUPN\\r\\n| project UserPrincipalName, AssignedRoles=strcat(AssignedRoles), GroupMemberships=strcat(GroupMembership);\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| summarize count() by UserPrincipalName, UserProfile, UserId\\r\\n| join (Roles) on UserPrincipalName\\r\\n| where AssignedRoles contains \\\"security\\\" or AssignedRoles contains \\\"admin\\\" or GroupMemberships contains \\\"security\\\" or GroupMemberships contains \\\"admin\\\"\\r\\n| project UserPrincipalName, UserProfile, SignInCount=count_, AssignedRoles, GroupMemberships, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Designate Emergency Accounts & Monitor Access\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"LastSignIn\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"SignInsBeforeInactive\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":2500,\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Privileged Access Workstations (PA-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-6-use-privileged-access-workstations)\\r\\n\\r\\nSecured, isolated workstations are critically important for the security of sensitive roles like administrator, developer, and critical service operator.\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Privileged Access Workstations](https://docs.microsoft.com/security/compass/privileged-access-deployment)
\\r\\n\\r\\n### Microsoft Portal\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## [Privileged Access Deployment](https://docs.microsoft.com/security/compass/privileged-access-deployment)\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-4 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isPA6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Follow Just Enough Administration Principle (PA-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-7-follow-just-enough-administration-least-privilege-principle)\\r\\n\\r\\nFollow the just enough administration (least privilege) principle to manage permissions at fine-grained level. Use features such as role-based access control (RBAC) to manage resource access through role assignments.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Activity]( https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [What is Azure Role-Based Access Control (Azure RBAC)](https://docs.microsoft.com/azure/role-based-access-control/overview)
\\r\\n💡 [How to Configure Azure RBAC](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal)
\\r\\n💡 [How to Use Microsoft Entra ID Identity and Access Reviews](https://docs.microsoft.com/azure/active-directory/governance/access-reviews-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PA.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AuditLogs\\r\\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\\r\\n| summarize Runs = count(), Success = countif(Result == 'success'), Fails = countif(Result != 'success') by OperationName // Summarize the total, successful and failed operations by name\\r\\n| extend SuccessRate = (Success * 100 / Runs) // Calculate the percentage of successful operations against the total\\r\\n| project OperationName, Runs, SuccessRate, Fails\\r\\n| sort by Runs desc\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Monitor Privileged User Operations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Runs\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"SuccessRate\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redGreen\"}},{\"columnMatch\":\"Fails\",\"formatter\":8,\"formatOptions\":{\"palette\":\"red\"}},{\"columnMatch\":\"UserId\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"resource\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"OfficeWorkload\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"resource\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_heatmap_Fails_3\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_heatmap_Fails_3\",\"sortOrder\":1}]},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let data = AuditLogs\\r\\n| extend UserPrincipalName = tostring(InitiatedBy.user.userPrincipalName)\\r\\n | where \\\"All\\\" == \\\"All\\\" or Result in ('All')\\r\\n | extend initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\")\\r\\n | where \\\"All\\\" == \\\"All\\\" or initiator in ('All')\\r\\n | where \\\"All\\\" == \\\"All\\\" or Category in ('All')\\r\\n | where Category == 'All' or 'All' == \\\"All\\\";\\r\\nlet appData = data\\r\\n | summarize TotalCount = count() by OperationName, Category\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName\\r\\n | project-away TimeGenerated)\\r\\n on OperationName\\r\\n | order by TotalCount desc, OperationName asc\\r\\n | project OperationName, TotalCount, Trend, Category\\r\\n | serialize Id = row_number();\\r\\ndata\\r\\n| summarize TotalCount = count() by initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\"), Category, OperationName\\r\\n| join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated in range(ago(7d), now(), 3h) by OperationName, initiator = iif (tostring(InitiatedBy.user.userPrincipalName) != \\\"\\\", tostring(InitiatedBy.user.userPrincipalName), \\\"unknown\\\")\\r\\n | project-away TimeGenerated)\\r\\n on OperationName, initiator\\r\\n| order by TotalCount desc, OperationName asc\\r\\n| project OperationName, initiator, TotalCount, Category, Trend\\r\\n| serialize Id = row_number(1000000)\\r\\n| join kind=inner (appData) on OperationName\\r\\n| project Id, Name = initiator, Type = 'initiator', ['Operations Count'] = TotalCount, Trend, ParentId = Id1\\r\\n| union (appData \\r\\n | project Id, Name = OperationName, Type = 'Operation', ['Operations Count'] = TotalCount, Trend)\\r\\n| order by ['Operations Count'] desc, Name asc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Monitor Privileged User Activities\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"exportParameterName\":\"UserInfo\",\"exportDefaultValue\":\"{ \\\"Name\\\":\\\"\\\", \\\"Type\\\":\\\"*\\\"}\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Id\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Type\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Operations Count\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"blue\",\"showIcon\":true},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"min\":0,\"palette\":\"turquoise\",\"showIcon\":true},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"ParentId\",\"formatter\":5,\"formatOptions\":{\"showIcon\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"idColumn\":\"Id\",\"parentColumn\":\"ParentId\",\"treeType\":0,\"expanderColumn\":\"Name\"}},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Determine Access Process for Support (PA-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access#pa-8-determine-access-process-for-cloud-provider-support)\\r\\n\\r\\nEstablish an approval process and access path for requesting and approving vendor support request and temporary access to your data through a secure channel.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Customer Lockbox](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Customer Lockbox](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\\r\\n💡 [Establish Approval Process for Vendor Support Access with Azure Lockbox](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/ActivityLog)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Customer Lockbox](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationName contains \\\"lockbox\\\"\\r\\n| sort by TimeGenerated desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Customer Lockbox Activity\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"info\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPA8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PA-8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isPAVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Privileged Access Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Data Protection (DP)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection) \\r\\n---\\r\\nData Protection covers control of data protection at rest, in transit, and via authorized access mechanisms, including discover, classify, protect, and monitor sensitive data assets using access control, encryption, and logging in Azure.\"},\"customWidth\":\"40\",\"name\":\"DP Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Discover, Classify, & Label Sensitive Data (DP-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Monitor Anomalies & Threats Targeting Sensitive Data (DP-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Encrypt Sensitive Data in Transit (DP-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Data at Rest Encryption by Default (DP-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1ecc3fc5-0702-423d-9bb8-5655a8dfbbeb\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"17084acc-f6d3-468e-acf2-b8495a892526\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e3ffa459-386a-4c1e-925f-49f2fa7abeee\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Customer-Managed Keys (DP-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Secure Key Management (DP-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Secure Certificate Management (DP-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Security of Key & Certificate Repository (DP-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DP8\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"dcbe4289-9536-4684-92a1-1b8ab38ae4d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7989a6c0-1e87-4b65-bcd5-5825349ec18c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"3bc5bd51-d93c-4c6c-9cd2-36f5b0b96443\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"892d1c80-5dd4-4937-9527-36b21bf9eacf\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDP8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DP8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Discover, Classify, & Label Sensitive Data (CP-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-1-discover-classify-and-label-sensitive-data)\\r\\n\\r\\nEstablish and maintain an inventory of the sensitive data, based on the defined sensitive data scope. Use tools to discover, classify and label the in- scope sensitive data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Data classification overview](https://docs.microsoft.com/azure/cloud-adoption-framework/govern/policy-compliance/data-classification)
\\r\\n💡 [Label your sensitive data using Azure Purview](https://docs.microsoft.com/azure/purview/create-sensitivity-label)
\\r\\n💡 [Tag Sensitive Information Using Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\\r\\n💡 [How to implement Azure SQL Data Discovery](https://docs.microsoft.com/azure/azure-sql/database/data-discovery-and-classification-overview)
\\r\\n💡 [Azure Purview data sources](https://docs.microsoft.com/azure/purview/purview-connector-overview#purview-data-sources)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InformationProtectionLogs_CL\\r\\n| extend AIP = strcat(\\\"https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/ActivityLogsBlade\\\")\\r\\n| summarize count() by LabelName_s, AIP\\r\\n| sort by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Data Labeling via Azure Information Protection\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LabelName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AIP\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Azure Information Protection >>\",\"bladeOpenContext\":{\"bladeName\":\"DataClassGroupEditBlade\",\"extensionName\":\"Microsoft_Azure_InformationProtection\"}}},{\"columnMatch\":\"User\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProtectionOwner\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"PersonWithFriend\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}},{\"columnMatch\":\"UserId_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProductName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"UPN\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Incident >\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"city_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"state_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Monitor Anomalies & Threats Targeting Sensitive Data (DP-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-2-monitor-anomalies-and-threats-targeting-sensitive-data)\\r\\n\\r\\nMonitor for anomalies around sensitive data, such as unauthorized transfer of data to locations outside of enterprise visibility and control. This typically involves monitoring for anomalous activities (large or unusual transfers) that could indicate unauthorized data exfiltration.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Enable Azure Defender for SQL](https://docs.microsoft.com/azure/azure-sql/database/azure-defender-for-sql)
\\r\\n💡 [Enable Azure Defender for Storage](https://docs.microsoft.com/azure/storage/common/storage-advanced-threat-protection?tabs=azure-security-center)
\\r\\n\\r\\n### Microsoft Logs\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"data\\\" or Title contains \\\"access\\\" or Title contains \\\"sensitive\\\" or Tactics == \\\"exfiltration\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Sensitive Data\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Encrypt Sensitive Data in Transit (DP-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-3-encrypt-sensitive-data-in-transit)\\r\\n\\r\\nProtect the data in transit against 'out of band' attacks (such as traffic capture) using encryption to ensure that attackers cannot easily read or modify the data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Double encryption for Azure data in transit](https://docs.microsoft.com/azure/security/fundamentals/double-encryption#data-in-transit)
\\r\\n💡 [Understand encryption in transit with Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
\\r\\n💡 [Information on TLS Security](https://docs.microsoft.com/security/engineering/solving-tls1-problem)
\\r\\n💡 [Enforce secure transfer in Azure storage](https://docs.microsoft.com/azure/storage/common/storage-require-secure-transfer?toc=/azure/storage/blobs/toc.json#require-secure-transfer-for-a-new-storage-account)
\\r\\n\\r\\n## Microsoft Portals \\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Data at Rest Encryption by Default (DP-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-4-enable-data-at-rest-encryption-by-default)\\r\\n\\r\\nTo complement access controls, data at rest should be protected against 'out of band' attacks (such as accessing underlying storage) using encryption. This helps ensure that attackers cannot easily read or modify the data.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Encryption at Rest in Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest#encryption-at-rest-in-microsoft-cloud-services)
\\r\\n💡 [Data at Rest Double Encryption in Azure](https://docs.microsoft.com/azure/security/fundamentals/double-encryption#data-at-rest)
\\r\\n💡 [Encryption Model and Key Management Table](https://docs.microsoft.com/azure/security/fundamentals/encryption-models)
\\r\\n💡 [Security architecture](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Customer-Managed Key Option in Data at Rest Encryption When Required (DP-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-5-use-customer-managed-key-option-in-data-at-rest-encryption-when-required)\\r\\n\\r\\nIf required for regulatory compliance, define the use case and service scope where customer-managed key option is needed. Enable and implement data at rest encryption using customer-managed key in services. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Encryption model and key management table](https://docs.microsoft.com/azure/security/fundamentals/encryption-models)
\\r\\n💡 [Services that support encryption using customer-managed key](https://docs.microsoft.com/azure/security/fundamentals/encryption-models#supporting-services)
\\r\\n💡 [How to configure customer managed encryption keys in Azure Storage](https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use a Secure Key Management Process (DP-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-6-use-a-secure-key-management-process)\\r\\n\\r\\nDocument and implement an enterprise cryptographic key management standard, processes, and procedures to control your key lifecycle. When there is a need to use customer-managed key in the services, use a secured key vault service for key generation, distribution, and storage. Rotate and revoke your keys based on the defined schedule and when there is a key retirement or compromise.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure Key Vault overview](https://docs.microsoft.com/azure/key-vault/general/overview)
\\r\\n💡 [Azure data encryption at rest--Key Hierarchy](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest#key-hierarchy)
\\r\\n💡 [BYOK (Bring Your Own Key) specification](https://docs.microsoft.com/azure/key-vault/keys/byok-specification)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"// Run query to see results.\\r\\nresources\\r\\n| where type =~ 'Microsoft.KeyVault/vaults'\\r\\n| project name,resourceGroup,location,id,type,subscriptionId,kind,tags\\r\\n| extend typeDisplayName=case(type =~ 'microsoft.keyvault/vaults','Key vault',type)\\r\\n| extend locationDisplayName=case(location =~ 'eastus','East US',location =~ 'eastus2','East US 2',location =~ 'southcentralus','South Central US',location =~ 'westus2','West US 2',location =~ 'westus3','West US 3',location =~ 'australiaeast','Australia East',location =~ 'southeastasia','Southeast Asia',location =~ 'northeurope','North Europe',location =~ 'swedencentral','Sweden Central',location =~ 'uksouth','UK South',location =~ 'westeurope','West Europe',location =~ 'centralus','Central US',location =~ 'northcentralus','North Central US',location =~ 'westus','West US',location =~ 'southafricanorth','South Africa North',location =~ 'centralindia','Central India',location =~ 'eastasia','East Asia',location =~ 'japaneast','Japan East',location =~ 'jioindiawest','Jio India West',location =~ 'koreacentral','Korea Central',location =~ 'canadacentral','Canada Central',location =~ 'francecentral','France Central',location =~ 'germanywestcentral','Germany West Central',location =~ 'norwayeast','Norway East',location =~ 'switzerlandnorth','Switzerland North',location =~ 'uaenorth','UAE North',location =~ 'brazilsouth','Brazil South',location =~ 'centralusstage','Central US (Stage)',location =~ 'eastusstage','East US (Stage)',location =~ 'eastus2stage','East US 2 (Stage)',location =~ 'northcentralusstage','North Central US (Stage)',location =~ 'southcentralusstage','South Central US (Stage)',location =~ 'westusstage','West US (Stage)',location =~ 'westus2stage','West US 2 (Stage)',location =~ 'asia','Asia',location =~ 'asiapacific','Asia Pacific',location =~ 'australia','Australia',location =~ 'brazil','Brazil',location =~ 'canada','Canada',location =~ 'europe','Europe',location =~ 'france','France',location =~ 'germany','Germany',location =~ 'global','Global',location =~ 'india','India',location =~ 'japan','Japan',location =~ 'korea','Korea',location =~ 'norway','Norway',location =~ 'southafrica','South Africa',location =~ 'switzerland','Switzerland',location =~ 'uae','United Arab Emirates',location =~ 'uk','United Kingdom',location =~ 'unitedstates','United States',location =~ 'eastasiastage','East Asia (Stage)',location =~ 'southeastasiastage','Southeast Asia (Stage)',location =~ 'westcentralus','West Central US',location =~ 'southafricawest','South Africa West',location =~ 'australiacentral','Australia Central',location =~ 'australiacentral2','Australia Central 2',location =~ 'australiasoutheast','Australia Southeast',location =~ 'japanwest','Japan West',location =~ 'jioindiacentral','Jio India Central',location =~ 'koreasouth','Korea South',location =~ 'southindia','South India',location =~ 'westindia','West India',location =~ 'canadaeast','Canada East',location =~ 'francesouth','France South',location =~ 'germanynorth','Germany North',location =~ 'norwaywest','Norway West',location =~ 'switzerlandwest','Switzerland West',location =~ 'ukwest','UK West',location =~ 'uaecentral','UAE Central',location =~ 'brazilsoutheast','Brazil Southeast',location)\\r\\n| extend tagsString=tostring(tags)\\r\\n| where (type !~ ('dynatrace.observability/monitors'))\\r\\n| where (type !~ ('nginx.nginxplus/nginxdeployments'))\\r\\n| where (type !~ ('microsoft.agfoodplatform/farmbeats'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/customdomains'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/origingroups'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/rulesets'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/secrets'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/securitypolicies'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/afdendpoints/routes'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/origingroups/origins'))\\r\\n| where (type !~ ('microsoft.cdn/profiles/rulesets/rules'))\\r\\n| where (type !~ ('microsoft.kubernetes/connectedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\\r\\n| where (type !~ ('microsoft.containerservice/managedclusters/microsoft.kubernetesconfiguration/fluxconfigurations'))\\r\\n| where (type !~ ('microsoft.portal/extensions/deployments'))\\r\\n| where (type !~ ('microsoft.portal/extensions'))\\r\\n| where (type !~ ('microsoft.portal/extensions/slots'))\\r\\n| where (type !~ ('microsoft.portal/extensions/versions'))\\r\\n| where (type !~ ('microsoft.datacollaboration/workspaces'))\\r\\n| where (type !~ ('microsoft.network/dnsforwardingrulesets'))\\r\\n| where (type !~ ('microsoft.network/dnsresolvers'))\\r\\n| where (type !~ ('microsoft.azurestack/registrations'))\\r\\n| where (type !~ ('microsoft.communication/emailservices'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools/clusters/sessionclusters'))\\r\\n| where (type !~ ('microsoft.hdinsight/clusterpools'))\\r\\n| where (type !~ ('microsoft.hpcworkbench/instances'))\\r\\n| where (type !~ ('microsoft.scvmm/vmmservers'))\\r\\n| where (type !~ ('microsoft.connectedvmwarevsphere/vcenters'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/assets'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/tests'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/executionplans'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins/testplans'))\\r\\n| where (type !~ ('microsoft.intelligentitdigitaltwin/digitaltwins'))\\r\\n| where not((type =~ ('microsoft.network/serviceendpointpolicies')) and ((kind =~ ('internal'))))\\r\\n| where (type !~ ('microsoft.openlogisticsplatform/workspaces'))\\r\\n| where (type !~ ('microsoft.scom/managedinstances'))\\r\\n| where (type !~ ('microsoft.orbital/spacecrafts/contacts'))\\r\\n| where (type !~ ('microsoft.orbital/contactprofiles'))\\r\\n| where (type !~ ('microsoft.orbital/edgesites'))\\r\\n| where (type !~ ('microsoft.orbital/groundstations'))\\r\\n| where (type !~ ('microsoft.orbital/l2connections'))\\r\\n| where (type !~ ('microsoft.orbital/spacecrafts'))\\r\\n| where (type !~ ('microsoft.azurepercept/accounts'))\\r\\n| where (type !~ ('microsoft.workloads/phpworkloads'))\\r\\n| where (type !~ ('microsoft.playfab/playeraccountpools'))\\r\\n| where (type !~ ('microsoft.playfab/playfabresources'))\\r\\n| where (type !~ ('microsoft.playfab/titles'))\\r\\n| where (type !~ ('microsoft.recommendationsservice/accounts/modeling'))\\r\\n| where (type !~ ('microsoft.recommendationsservice/accounts/serviceendpoints'))\\r\\n| where (type !~ ('microsoft.recoveryservicesbvtd2/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesbvtd/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesintd/vaults'))\\r\\n| where (type !~ ('microsoft.recoveryservicesintd2/vaults'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/applicationinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/centralinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances/databaseinstances'))\\r\\n| where (type !~ ('microsoft.workloads/sapvirtualinstances'))\\r\\n| where (type !~ ('microsoft.datareplication/replicationvaults'))\\r\\n| where (type !~ ('microsoft.storagecache/amlfilesystems'))\\r\\n| where not((type =~ ('microsoft.synapse/workspaces/sqlpools')) and ((kind =~ ('v3'))))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/sites'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/packetcorecontrolplanes'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/mobilenetworks/services'))\\r\\n| where (type !~ ('microsoft.mobilenetwork/sims'))\\r\\n| where (type !~ ('microsoft.workloads/monitors'))\\r\\n| where not((type =~ ('microsoft.sql/servers/databases')) and ((kind in~ ('system','v2.0,system','v12.0,system','v12.0,user,datawarehouse,gen2,analytics'))))\\r\\n| where not((type =~ ('microsoft.sql/servers')) and ((kind =~ ('v12.0,analytics'))))\\r\\n| project id,typeDisplayName,resourceGroup,locationDisplayName,tagsString,name,type,kind,location,subscriptionId,tags\\r\\n| sort by (tolower(tostring(name))) asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use a Secure Certificate Management Process (DP-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-7-use-a-secure-certificate-management-process)\\r\\n\\r\\nDocument and implement an enterprise certificate management standard, processes and procedures which includes the certificate lifecycle control, and certificate policies (if a public key infrastructure is needed). \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n \\r\\n## Implementation\\r\\n💡 [Get started with Key Vault certificates](https://docs.microsoft.com/azure/key-vault/certificates/certificate-scenarios)
\\r\\n💡 [Certificate Access Control in Azure Key Vault](https://docs.microsoft.com/azure/key-vault/certificates/certificate-access-control)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n💡 [Security architecture](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-architecture)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.7\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"key\\\" or Title contains \\\"certificate\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Keys & Certificates\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Security of Key & Certificate Repository (DP-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection#dp-8-ensure-security-of-key-and-certificate-repository)\\r\\n\\r\\nEnsure the security of the key vault service used for the cryptographic key and certificate lifecycle management. Harden your key vault service through access control, network security, logging and monitoring and backup to ensure keys and certificates are always protected using the maximum security.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)\\r\\n \\r\\n## Implementation\\r\\n💡 [Azure Key Vault overview](https://docs.microsoft.com/azure/key-vault/general/overview)
\\r\\n💡 [Azure Key Vault security best practices](https://docs.microsoft.com/azure/key-vault/general/best-practices)
\\r\\n💡 [Use managed identity to access Azure Key Vault](https://docs.microsoft.com/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad)
\\r\\n💡 [Identity and key management](https://docs.microsoft.com/azure/cloud-adoption-framework/organize/cloud-security-identity-keys)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Key Vault](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DP.8\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity \\r\\n| where OperationNameValue startswith \\\"Microsoft.KeyVault\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault: Access & Policy Changes\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 7 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where ResourceProvider == \\\"MICROSOFT.KEYVAULT\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| limit 100\\r\\n\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Key Vault: Operations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"rowLimit\":100,\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDP8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DP-8\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isDPVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Data Protection Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Asset Management (AM)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management) \\r\\n---\\r\\nAsset Management covers controls to ensure security visibility and governance over Azure resources, including recommendations on permissions for security personnel, security access to asset inventory, and managing approvals for services and resources (inventory, track, and correct). \"},\"customWidth\":\"40\",\"name\":\"AM Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"A\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Track Asset Inventory & Risks (AM-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Only Approved Services (AM-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Security of Asset Lifecycle Management (AM-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Limit Access to Asset Management (AM-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Only Approved Apps in Virtual Machine (AM-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"AM5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"3b5c2b30-6e56-4326-9416-89041b15e51a\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"262d5814-d29c-45a0-bb16-6506c0e315fe\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1765861c-fdf7-4445-9378-9996ac409814\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isAM5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"AM5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"5da235d1-704b-478b-9325-e2aa8d5458ee\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Track Asset Inventory & Risks (AM-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-1-track-asset-inventory-and-their-risks)\\r\\n\\r\\nTrack your asset inventory by query and discover all your cloud resources. Logically organize your assets by tagging and grouping your assets based on their service nature, location, or other characteristics. Ensure your security organization has access to a continuously updated inventory of assets.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Create Queries with Azure Resource Graph Explorer](https://docs.microsoft.com/azure/governance/resource-graph/first-query-portal)
\\r\\n💡 [Microsoft Defender for Cloud Asset Inventory Management](https://docs.microsoft.com/azure/security-center/asset-inventory)
\\r\\n💡 [For More Information About Tagging Assets, See the Resource Naming and Tagging Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=%2fazure%2fazure-resource-manager%2fmanagement%2ftoc.json)
\\r\\n💡 [Overview of Security Reader Role](https://docs.microsoft.com/azure/role-based-access-control/built-in-roles#security-reader)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud: Inventory](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/25)
\\r\\n🔀 [Microsoft Defender XDR: Software Inventory](https://security.microsoft.com/software-inventory/applications)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| extend Azure_Inventory=location\\r\\n| extend M365_Inventory=strcat(\\\"https://security.microsoft.com/machines\\\")\\r\\n| project AssetID=id,AssetType=type, Azure_Inventory, M365_Inventory\\r\\n| sort by AssetID asc\\r\\n| limit 2500\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Inventory\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Azure_Inventory\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Azure Inventory >>\",\"bladeOpenContext\":{\"bladeName\":\"InventoryBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"\",\"source\":\"static\",\"value\":\"25\"}]}}},{\"columnMatch\":\"DefenderXDR_Inventory\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"DefenderXDR Inventory >>\"}}],\"rowLimit\":2500,\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"microsoft\\\"\\r\\n| project id,type,resourceGroup, tags\\r\\n| extend tag = strcat(tags)\\r\\n| summarize count() by tag\\r\\n| where tag <> \\\"\\\" \\r\\n| where tag <> \\\"{}\\\" \\r\\n| sort by count_ desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Tags Currently In Use\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"properties_storageProfile_osDisk_osType\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Windows\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Linux\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"green\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"🟦 Tags Currently In Use\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isAM1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Only Approved Services (AM-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-2-use-only-approved-services)\\r\\n\\r\\nEnsure that only approved cloud services can be used, by auditing and restricting which services users can provision in the environment. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Configure and Manage Azure Policy](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n💡 [How to Deny a Specific Resource Type with Azure Policy](https://docs.microsoft.com/azure/governance/policy/samples/index)
\\r\\n💡 [How to Create Queries with Azure Resource Graph Explorer](https://docs.microsoft.com/azure/governance/resource-graph/first-query-portal)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"AM.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| summarize count() by type\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Count by Type\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Subscription}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Security of Asset Lifecycle Management (AM-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-3-ensure-security-of-asset-lifecycle-management)\\r\\n\\r\\nEnsure security attributes or configurations of the assets are always updated during the asset lifecycle. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Delete Azure Resource Group and Resource](https://docs.microsoft.com/azure/azure-resource-manager/management/delete-resource-group)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationName contains \\\"delete\\\" or OperationName contains \\\"remove\\\" or OperationName contains \\\"update\\\" or OperationName contains \\\"create\\\"\\r\\n| summarize count() by OperationName, Caller\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Asset Activity by User/Account\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"orange\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isAM3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Limit Access to Asset Management (AM-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-4-limit-access-to-asset-management)\\r\\n\\r\\nLimit users' access to asset management features, to avoid accidental or malicious modification of the assets in your cloud. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Conditional Access to Block Access to Azure Resources Manager](https://docs.microsoft.com/azure/role-based-access-control/conditional-access-azure-management)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let LastObserved = SigninLogs\\r\\n| where ResultType == 0\\r\\n| where ResourceDisplayName contains \\\"Manage\\\" or ResourceDisplayName contains \\\"graph\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\\r\\n| project UserPrincipalName, LastObservedAccess=TimeGenerated;\\r\\nSigninLogs\\r\\n| extend UserProfile = strcat(\\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\\\", UserId)\\r\\n| where ResultType == 0\\r\\n| where ResourceDisplayName contains \\\"Manage\\\" or ResourceDisplayName contains \\\"graph\\\"\\r\\n| summarize count() by UserPrincipalName, ResourceDisplayName, UserProfile, UserId\\r\\n| join (LastObserved) on UserPrincipalName\\r\\n| project UserPrincipalName, SignInCount=count_, ResourceDisplayName, UserProfile, LastObservedAccess, UserId\\r\\n| sort by SignInCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Management Function Access\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"SignInCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"UserProfile\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Entra ID User Profile >>\",\"bladeOpenContext\":{\"bladeName\":\"UserDetailsMenuBlade\",\"extensionName\":\"Microsoft_AAD_IAM\",\"bladeParameters\":[{\"name\":\"userId\",\"source\":\"column\",\"value\":\"UserId\"}]}}},{\"columnMatch\":\"UserId\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Only Approved Apps in Virtual Machine (AM-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-asset-management#am-5-use-only-approved-applications-in-virtual-machine)\\r\\n\\r\\nEnsure that only authorized software executes by creating an allow list and block the unauthorized software from executing in your environment.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Use Microsoft Defender for Cloud Adaptive Application Controls](https://docs.microsoft.com/azure/security-center/security-center-adaptive-application)
\\r\\n💡 [Understand Azure Automation Change Tracking and Inventory](https://docs.microsoft.com/azure/automation/change-tracking/overview)
\\r\\n💡 [How to Control PowerShell Script Execution in Windows Environments](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\"},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"AM.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isAM5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"AM-5\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isAMVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Asset Management Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Logging & Threat Detection (LT)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection) \\r\\n---\\r\\nLogging and Threat Detection covers controls for detecting threats on Azure and enabling, collecting, and storing audit logs for Azure services, including enabling detection, investigation, and remediation processes with controls to generate high-quality alerts with native threat detection in Azure services; it also includes collecting logs with Azure Monitor, centralizing security analysis with Microsoft Sentinel, time synchronization, and log retention.\"},\"customWidth\":\"40\",\"name\":\"LT Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Threat Detection Capabilities (LT-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Threat Detection for Identity & Access Management (LT-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Logging for Security Investigation (LT-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Limit Access to Asset Management (LT-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"61226164-0f22-4271-bd57-aebde7d72af1\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"1e93ea31-59fd-41fd-9f44-1ea9447c6779\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"c92c1ebd-90ac-466d-81b6-0b4a7e5e4cab\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Centralize Security Log Management & Analysis (LT-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Configure Log Storage Retention (LT-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Approved Time Synchronization Sources (LT-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"LT7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6ee1efad-6ae5-4c5b-9ecf-29c52d5999e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"5bc1802f-413f-426c-b292-074f215308e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"11afdb83-5ddc-446a-832f-91dc11c06125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isLT7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"LT7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Threat Detection Capabilities (LT-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-1-enable-threat-detection-capabilities)\\r\\n\\r\\nTo support threat detection scenarios, monitor all known resource types for known and expected threats and anomalies. Configure your alert filtering and analytics rules to extract high-quality alerts from log data, agents, or other data sources to reduce false positives.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Identity]( https://www.microsoft.com/microsoft-365/security/identity-defender)
\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Threat Protection in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/azure-defender)
\\r\\n💡 [Microsoft Defender for Cloud Security Alerts Reference Guide](https://docs.microsoft.com/azure/security-center/alerts-reference)
\\r\\n💡 [Create Custom Analytics Rules to Detect Threats](https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom)
\\r\\n💡 [Cyber Threat Intelligence with Microsoft Sentinel](https://docs.microsoft.com/azure/architecture/example-scenario/data/sentinel-threat-intelligence)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\\r\\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\\r\\n🔀 [Microsoft Defender for IoT](https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started)
\\r\\n🔀 [Microsoft Defender for Identity](https://security.microsoft.com/settings/identities)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SecurityProducts = datatable(ProviderName:string, Product:string, Portal:string)\\r\\n[\\r\\n \\\"ASI Scheduled Alerts\\\", \\\"Microsoft Sentinel\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"MCAS\\\", \\\"Microsoft Defender for Cloud Apps\\\", \\\"https://portal.cloudappsecurity.com/\\\",\\r\\n \\\"MDATP\\\", \\\"Microsoft Defender for Endpoint\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"Azure Security Center\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"Detection-WarmPathV2\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"MicrosoftThreatProtection\\\", \\\"Microsoft 365 Defender\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"IPC\\\", \\\"Azure Active Directory Identity Protection\\\", \\\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/Overview\\\",\\r\\n \\\"Detection-Fusion\\\", \\\"Machine Learning Fusion Alert\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"Sentinel Fusion\\\", \\\"Machine Learning Fusion Alert\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"Azure Advanced Threat Protection\\\", \\\"Microsoft Defender for Identity\\\", \\\"https://security.microsoft.com/settings/identities\\\",\\r\\n \\\"Threat Intelligence Alerts\\\", \\\"Threat Intelligence\\\", \\\"https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel\\\",\\r\\n \\\"IoTSecurity\\\", \\\"Microsoft Defender for IoT\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started\\\",\\r\\n \\\"MSTIC\\\", \\\"Microsoft Intelligent Security Graph\\\", \\\"https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade\\\",\\r\\n \\\"AntimalwarePublisher\\\", \\\"Microsoft Anti-Malware\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"OATP\\\", \\\"Microsoft Defender for Office 365\\\", \\\"https://security.microsoft.com/homepage\\\",\\r\\n \\\"AdaptiveNetworkHardenings\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"StorageThreatDetection\\\", \\\"Azure Defender for Storage\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\",\\r\\n \\\"CloudNetworkSecurity\\\", \\\"Azure Network Security\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview\\\",\\r\\n \\\"SQLThreatDetection\\\", \\\"Microsoft Defender for Cloud\\\", \\\"https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0\\\"\\r\\n];\\r\\nSecurityAlert\\r\\n| join kind=inner SecurityProducts on ProviderName\\r\\n| summarize count() by Product, Portal\\r\\n| sort by count_ desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Alerts Count by Product\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Product\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Defense Evasion\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Portal\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Portal >>\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ProductName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"UPN\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Incident >\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"city_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"state_\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Threat Detection for Identity & Access Management (LT-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-2-enable-threat-detection-for--identity-and-access-management)\\r\\n\\r\\nDetect threats for identities and access management by monitoring the user and application sign-in and access anomalies. Behavioral patterns such as excessive number of failed login attempts, and deprecated accounts in the subscription, should be alerted.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) \\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Microsoft Entra ID](https://azure.microsoft.com/services/active-directory/)
\\r\\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Audit activity reports in Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs)
\\r\\n💡 [Enable Azure Identity Protection](https://docs.microsoft.com/azure/active-directory/identity-protection/overview-identity-protection)
\\r\\n💡 [Threat Protection in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/azure-defender)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Entra ID](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let AnomalousSigninActivity = BehaviorAnalytics\\r\\n | where ActionType == \\\"Sign-in\\\"\\r\\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\\r\\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\\r\\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\\r\\n | join (\\r\\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \\\"none\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Successful Logon\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indicaiton from AAD\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\\r\\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//witdstomstl\\r\\nlet AnomalousRoleAssignment = AuditLogs\\r\\n | where TimeGenerated > ago(28d)\\r\\n | where OperationName == \\\"Add member to role\\\"\\r\\n | mv-expand TargetResources\\r\\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\\r\\n | where isnotempty(RoleId) and RoleId in (critical, high)\\r\\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\\r\\n | where isnotempty(RoleName)\\r\\n | extend TargetId = tostring(TargetResources.id)\\r\\n | extend Target = tostring(TargetResources.userPrincipalName)\\r\\n | join kind=inner (\\r\\n BehaviorAnalytics\\r\\n | where ActionType == \\\"Add member to role\\\"\\r\\n | where UsersInsights.BlasrRadius == \\\"High\\\" or ActivityInsights.FirstTimeUserPerformedAction == true\\r\\n )\\r\\n on $left._ItemId == $right.SourceRecordId\\r\\n | extend AnomalyName = \\\"Anomalous Role Assignemt\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Account Manipulation\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to priveleged role, or ones that add users for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, RoleName, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; let LogOns=materialize(\\r\\n BehaviorAnalytics\\r\\n | where ActivityType == \\\"LogOn\\\");\\r\\nlet AnomalousResourceAccess = LogOns\\r\\n | where ActionType == \\\"ResourceAccess\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | extend AnomalyName = \\\"Anomalous Resource Access\\\",\\r\\n Tactic = \\\"Lateral Movement\\\",\\r\\n Technique = \\\"\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousRDPActivity = LogOns\\r\\n | where ActionType == \\\"RemoteInteractiveLogon\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | extend AnomalyName = \\\"Anomalous RDP Activity\\\",\\r\\n Tactic = \\\"Lateral Movement\\\",\\r\\n Technique = \\\"\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousLogintoDevices = LogOns\\r\\n | where ActionType == \\\"InteractiveLogon\\\"\\r\\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\\r\\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\\r\\n | extend AnomalyName = \\\"Anomalous Login To Devices\\\",\\r\\n Tactic = \\\"Privilege Escalation\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administator users performing an interactive logon (4624:2) to a device for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousPasswordReset = BehaviorAnalytics\\r\\n | where ActionType == \\\"Reset user password\\\"\\r\\n | where ActivityInsights.FirstTimeUserPerformedAction == \\\"True\\\"\\r\\n | join (\\r\\n AuditLogs\\r\\n | where OperationName == \\\"Reset user password\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | mv-expand TargetResources\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Password Reset\\\",\\r\\n Tactic = \\\"Impact\\\",\\r\\n Technique = \\\"Account Access Removal\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority\\r\\n | sort by TimeGenerated desc;\\r\\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\\r\\n | where ActionType == \\\"Sign-in\\\"\\r\\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\\r\\n | join (\\r\\n SigninLogs\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Successful Logon\\\",\\r\\n Tactic = \\\"Initial Access\\\",\\r\\n Technique = \\\"Valid Accounts\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousFailedLogon = BehaviorAnalytics\\r\\n | where ActivityType == \\\"LogOn\\\"\\r\\n | where UsersInsights.BlastRadius == \\\"High\\\"\\r\\n | join (\\r\\n SigninLogs \\r\\n | where Status.errorCode == 50126\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Failed Logon\\\",\\r\\n Tactic = \\\"Credential Access\\\",\\r\\n Technique = \\\"Brute Force\\\",\\r\\n SubTechnique = \\\"Password Guessing\\\",\\r\\n Description = \\\"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"Evidence\\\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; \\r\\nlet AnomalousAADAccountManipulation = AuditLogs\\r\\n | where OperationName == \\\"Update user\\\"\\r\\n | mv-expand AdditionalDetails\\r\\n | where AdditionalDetails.key == \\\"UserPrincipalName\\\"\\r\\n | mv-expand TargetResources\\r\\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\\r\\n | where isnotempty(RoleId) and RoleId in (critical, high)\\r\\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\\r\\n | where isnotempty(RoleName)\\r\\n | extend TargetId = tostring(TargetResources.id)\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | join kind=inner ( \\r\\n BehaviorAnalytics\\r\\n | where ActionType == \\\"Update user\\\"\\r\\n | where UsersInsights.BlasrRadius == \\\"High\\\" or ActivityInsights.FirstTimeUserPerformedAction == true\\r\\n )\\r\\n on $left._ItemId == $right.SourceRecordId\\r\\n | extend UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName) \\r\\n | extend AnomalyName = \\\"Anomalous Account Manipulation\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Account Manipulation\\\",\\r\\n SubTechnique = \\\"\\\",\\r\\n Description = \\\"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to priveleged role, or ones that changed users for the first time.\\\"\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, RoleName, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\\r\\n | where ActionType == \\\"Add user\\\"\\r\\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\\r\\n | join(\\r\\n AuditLogs\\r\\n | where OperationName == \\\"Add user\\\"\\r\\n )\\r\\n on $left.SourceRecordId == $right._ItemId\\r\\n | mv-expand TargetResources\\r\\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(TargetResources.userPrincipalName, \\\"#\\\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\\r\\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\\r\\n UserPrincipalName = iff(UserPrincipalName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserPrincipalName),\\r\\n UserName = iff(UserName contains \\\"#EXT#\\\", replace(\\\"_\\\", \\\"@\\\", tostring(split(UserPrincipalName, \\\"#\\\")[0])), UserName)\\r\\n | extend AnomalyName = \\\"Anomalous Account Creation\\\",\\r\\n Tactic = \\\"Persistence\\\",\\r\\n Technique = \\\"Create Account\\\",\\r\\n SubTechnique = \\\"Cloud Account\\\",\\r\\n Description = \\\"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\\\"\\t\\r\\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\\\"TargetUser\\\"]=Target, [\\\"Evidence\\\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\\\"Anomaly Score\\\"]=InvestigationPriority\\r\\n | sort by TimeGenerated desc;\\r\\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\\r\\nlet TopUsersByAnomalies = AnomalyTable\\r\\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\\r\\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\\r\\n | sort by AnomalyCount desc;\\r\\nlet TopUsersByIncidents = SecurityIncident\\r\\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\\r\\n | where Status == \\\"New\\\" or Status == \\\"Active\\\"\\r\\n | mv-expand AlertIds\\r\\n | extend AlertId = tostring(AlertIds)\\r\\n | join kind= innerunique ( \\r\\n SecurityAlert \\r\\n )\\r\\n on $left.AlertId == $right.SystemAlertId\\r\\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\\r\\n | mv-expand todynamic(Entities)\\r\\n | where Entities[\\\"Type\\\"] =~ \\\"account\\\"\\r\\n | extend Name = tostring(tolower(Entities[\\\"Name\\\"])), NTDomain = tostring(Entities[\\\"NTDomain\\\"]), UPNSuffix = tostring(Entities[\\\"UPNSuffix\\\"]), AadUserId = tostring(Entities[\\\"AadUserId\\\"]), AadTenantId = tostring(Entities[\\\"AadTenantId\\\"]), \\r\\n Sid = tostring(Entities[\\\"Sid\\\"]), IsDomainJoined = tobool(Entities[\\\"IsDomainJoined\\\"]), Host = tostring(Entities[\\\"Host\\\"])\\r\\n | extend UPN = iff(Name != \\\"\\\" and UPNSuffix != \\\"\\\", strcat(Name, \\\"@\\\", UPNSuffix), \\\"\\\")\\r\\n | union TopUsersByAnomalies\\r\\n | extend \\r\\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\\r\\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\\r\\n UPNExists = iff(isempty(UPN), false, true),\\r\\n NameExists = iff(isempty(Name), false, true),\\r\\n SidExists = iff(isempty(Sid), false, true),\\r\\n AADExists = iff(isempty(AadUserId), false, true)\\r\\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\\r\\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\\r\\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\\r\\n | project [\\\"UserName\\\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\\\"AadUserId\\\"]=AadAnchor, [\\\"OnPremSid\\\"]=SidAnchor, [\\\"UserPrincipalName\\\"]=UPNAnchor;\\r\\nTopUsersByIncidents\\r\\n| where UserPrincipalName <> \\\"\\\"\\r\\n| where UserPrincipalName !contains \\\"[\\\"\\r\\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\\r\\n| sort by AlertCount desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" User Entity Behavior Analytics (UEBA)\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserPrincipalName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}},{\"columnMatch\":\"AlertCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}},{\"columnMatch\":\"AnomalyCount\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellow\"}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_heatmap_AlertCount_2\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_heatmap_AlertCount_2\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SigninStatus\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"green\"}},\"showBorder\":false},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"Location\",\"latitude\":\"SourceIPLocation\",\"longitude\":\"SourceIPLocation\",\"sizeSettings\":\"Location\",\"sizeAggregation\":\"Count\",\"legendMetric\":\"Location\",\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"Location\",\"colorAggregation\":\"Count\",\"type\":\"thresholds\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"blueDark\"}]}}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityAlert\\r\\n| where ProviderName == \\\"IPC\\\"\\r\\n| extend UserAccount = tostring(parse_json(ExtendedProperties).[\\\"User Account\\\"])\\r\\n| summarize count() by AlertName, AlertLink, ProductName, UserAccount\\r\\n| extend Count = count_\\r\\n| project AlertName, Count\\r\\n| sort by Count desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Entra ID Identity Protection: Security Alerts \",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Alert >\"}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Logging for Security Investigation (LT-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-3-enable-logging-for-security-investigation)\\r\\n\\r\\nEnable logging for your cloud resources to meet the requirements for security incident investigations and security response and compliance purposes.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Logging and Different Log Types in Azure](https://docs.microsoft.com/azure/azure-monitor/essentials/platform-logs-overview)
\\r\\n💡 [Understand Microsoft Defender for Cloud Data Collection](https://docs.microsoft.com/azure/security-center/security-center-enable-data-collection)
\\r\\n💡 [Enable and configure antimalware monitoring](https://docs.microsoft.com/azure/security/fundamentals/antimalware#enable-and-configure-antimalware-monitoring-using-powershell-cmdlets)
\\r\\n💡 [Operating systems and application logs inside in your compute resources](https://learn.microsoft.com/en-us/azure/azure-monitor/data-sources#operating-system-guest)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource = Table_Name *\\r\\n| summarize count() by Table_Name\\r\\n| project-rename Log_Tables=Table_Name, Logs_Count=count_\\r\\n| sort by Logs_Count desc\\r\\n| limit 100\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Logs Count by Data Table\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"Log_Tables\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Logs_Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Network Logging for Security Investigation (LT-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-4-enable-network-logging-for-security-investigation)\\r\\n\\r\\nEnable logging for your network services to support network-related incident investigations, threat hunting, and security alert generation. The network logs may include logs from network services such as IP filtering, network and application firewall, DNS, flow monitoring and so on. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/) ✳️ [Application Gateway]( https://azure.microsoft.com/services/application-gateway/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable Network Security Group Flow Logs](https://docs.microsoft.com/azure/network-watcher/network-watcher-nsg-flow-logging-portal)
\\r\\n💡 [Azure Firewall Logs and Metrics](https://docs.microsoft.com/azure/firewall/logs-and-metrics)
\\r\\n💡 [Azure Networking Monitoring Solutions in Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/insights/azure-networking-analytics)
\\r\\n💡 [Gather Insights About Your DNS Infrastructure With the DNS Analytics Solution](https://docs.microsoft.com/azure/azure-monitor/insights/dns-analytics)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\\r\\n🔀 [Azure Web Application Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FFrontDoorWebApplicationFirewallPolicies)
\\r\\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\\r\\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\\r\\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"where type contains \\\"microsoft.network\\\"\\r\\n| project id,type,resourceGroup\\r\\n| order by type asc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Networking Assets\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where OperationName == \\\"NetworkSecurityGroupEvents\\\"\\r\\n| summarize count() by ruleName_s\\r\\n| sort by count_ desc \\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Security Groups: Rules Triggered\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDiagnostics\\r\\n| where OperationName == \\\"NetworkSecurityGroupEvents\\\"\\r\\n| summarize count() by ruleName_s\\r\\n| project NetworkSecurityGroupRule=ruleName_s, FlowCount=count_\\r\\n| sort by FlowCount desc \",\"size\":0,\"showAnalytics\":true,\"title\":\"Flow Counts\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"NetworkSecurityGroupRule\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Lateral_Movement\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"FlowCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Centralize Security Log Management & Analysis (LT-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-5-centralize-security-log-management-and-analysis)\\r\\n\\r\\nCentralize logging storage and analysis to enable correlation across log data. For each log source, ensure that you have assigned a data owner, access guidance, storage location, what tools are used to process and access the data, and data retention requirements. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Collect Platform Logs and Metrics with Azure Monitor](https://docs.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings)
\\r\\n💡 [How to Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource=_TableName *\\r\\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\\\"second\\\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by _TableName, _IsBillable\\r\\n| project ['Table Name'] = _TableName, ['Table Size'] = Size, ['Table Entries'] = Entries,\\r\\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable\\r\\n| order by ['Table Size'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Log Table Management\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Table Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Table Size\",\"formatter\":8,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Entries\",\"formatter\":8,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Size per Entry\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"IsBillable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"True\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"False\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Important\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_IsBillable_4\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_IsBillable_4\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DataType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"union withsource=_TableName *\\r\\n| summarize count() , Size = sum(_BilledSize) by bin(_TimeReceived, 1m), Type, _IsBillable\\r\\n| extend counttemp =count_ / 60\\r\\n| summarize \\r\\n ['Current EPS Average']=avg(counttemp), ['Minimum EPS']=min(counttemp),\\r\\n ['Maximum EPS']=max(counttemp)\\r\\n by ['Table Name']=Type\\r\\n| order by ['Current EPS Average'] desc\",\"size\":0,\"showAnalytics\":true,\"title\":\" Log Table Events Per Second (EPS) Management\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Table Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current EPS Average\",\"formatter\":3,\"formatOptions\":{\"palette\":\"blueDark\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},{\"columnMatch\":\"Minimum EPS\",\"formatter\":3,\"formatOptions\":{\"palette\":\"red\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},{\"columnMatch\":\"Maximum EPS\",\"formatter\":3,\"formatOptions\":{\"palette\":\"green\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Size\",\"formatter\":8,\"formatOptions\":{\"palette\":\"purple\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Table Entries\",\"formatter\":8,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"Size per Entry\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"},\"numberFormat\":{\"unit\":2,\"options\":{\"style\":\"decimal\",\"useGrouping\":false}}},{\"columnMatch\":\"IsBillable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"True\",\"representation\":\"2\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"False\",\"representation\":\"success\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Important\",\"text\":\"{0}{1}\"}]}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_bar_Current EPS Average_1\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"$gen_bar_Current EPS Average_1\",\"sortOrder\":2}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DataType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Configure Log Storage Retention (LT-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-6-configure-log-storage-retention)\\r\\n\\r\\nPlan your log retention strategy according to your compliance, regulation, and business requirements. Configure the log retention policy at the individual logging services to ensure the logs are archived appropriately.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Change the Data Retention Period in Log Analytics](https://docs.microsoft.com/azure/azure-monitor/logs/manage-cost-storage#change-the-data-retention-period)
\\r\\n💡 [How to Configure Retention Policy for Azure Storage Account Logs](https://docs.microsoft.com/azure/storage/common/manage-storage-analytics-logs#configure-logging)
\\r\\n💡 [Microsoft Defender for Cloud Alerts and Recommendations Export](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"LT.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces' \\r\\n| extend state = trim(' ', tostring(properties.provisioningState))\\r\\n\\t\\t,sku = trim(' ', tostring(properties.sku.name))\\r\\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\\r\\n\\t\\t,retentionDays = trim(' ', tostring(properties.retentionInDays))\\r\\n\\t\\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\\r\\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\\\"Not set\\\")\\r\\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\\\"Unknown\\\")\\r\\n| extend sentinel = iif(toint(retentionDays) < 90,\\\"If you have Sentinel, you can change your retention to 90days (free)?\\\",\\\"\\\")\\r\\n| project ['Workspace Name']=id, ['Data Retention(days)']=retentionDays, ['Daily Data Cap']=dailyquotaGB, ['Resource Group']=resourceGroup, location, ['License']=sku\",\"size\":2,\"showAnalytics\":true,\"title\":\" Log Retention Configurations\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Computer\",\"formatter\":16,\"formatOptions\":{\"showIcon\":true}}],\"filter\":true,\"sortBy\":[{\"itemKey\":\"$gen_link_Workspace Name_0\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_link_Workspace Name_0\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"type\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false}},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\"}]},\"conditionalVisibility\":{\"parameterName\":\"isLT6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Approved Time Synchronization Sources (LT-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection#lt-7-use-approved-time-synchronization-sources)\\r\\n\\r\\nUse approved time synchronization sources for your logging time stamp which include date, time and time zone information.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [_Im_NetworkSession](https://docs.microsoft.com/azure/sentinel/network-normalization-schema) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Time Synchronization for Azure Windows Compute Resources](https://docs.microsoft.com/azure/virtual-machines/windows/time-sync)
\\r\\n💡 [How to Configure Time Synchronization for Azure Linux Compute Resources](https://docs.microsoft.com/azure/virtual-machines/linux/time-sync)
\\r\\n💡 [How to Disable Inbound UDP for Azure Services](https://support.microsoft.com/help/4558520/how-to-disable-inbound-udp-for-azure-services)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Entra ID Domain Services](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.AAD%2FdomainServices)
\\r\\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\\r\\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\"},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"_Im_NetworkSession\\r\\n| where NetworkProtocol == \\\"UDP\\\"\\r\\n| where NetworkDirection == \\\"outbound\\\"\\r\\n| where DstPortNumber == \\\"123\\\"\\r\\n| summarize count() by DstIpAddr\\r\\n| sort by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\" Network Time Protocol Calls by Destination IP\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isLT7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"LT-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isLTVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Logging & Threat Detection Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Incident Response (IR)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)\\r\\n---\\r\\nIncident Response covers controls in incident response life cycle - preparation, detection and analysis, containment, and post-incident activities, including using Azure services such as Microsoft Defender for Cloud and Sentinel to automate the incident response process. \"},\"customWidth\":\"40\",\"name\":\"IR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Update Incident Response Plan (IR-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Setup Incident Notification (IR-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Create Incidents Based in Alerts (IR-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Investigate an Incident (IR-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"fe9f6742-6af1-4434-9bbc-3aa855136070\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"8f0c3fdc-2da1-482b-962f-8b81f2edc636\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"b16aea45-a93f-4278-add1-33a0d763920d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Prioritize Incidents (IR-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Automate Incident Handling (IR-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Lessons Learned & Retain Evidence (IR-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"IR7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6ee1efad-6ae5-4c5b-9ecf-29c52d5999e1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"5bc1802f-413f-426c-b292-074f215308e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"11afdb83-5ddc-446a-832f-91dc11c06125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isIR7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"IR7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Preparation - Update Incident Response Plan & Handling Process (IR-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-1-preparation---update-incident-response-plan-and-handling-process)\\r\\n\\r\\nEnsure your organization follows industry best practice to develop processes and plans to respond to security incidents on the cloud platforms. Be mindful about the shared responsibility model and the variances across IaaS, PaaS and SaaS services. This will have a direct impact to how you collaborate with your cloud provider in incident response and handling activities, such as incident notification and triage, evidence collection, investigation, eradication and recovery.\\r\\n\\r\\n## Implementation\\r\\n💡 [Implement Security Across the Enterprise Environment](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\\r\\n💡 [Incident Response Reference Guide](https://docs.microsoft.com/microsoft-365/downloads/IR-Reference-Guide.pdf)
\\r\\n💡 [NIST SP 800-61 Computer Security Incident Handling Guide](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"name\":\"IR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Building Your Own Security Incident Response Process](https://msrc-blog.microsoft.com/2019/07/01/inside-the-msrc-building-your-own-security-incident-response-process/) \\r\\n![Image Name](https://msrc.microsoft.com/blog/2019/07/inside-the-msrc-building-your-own-security-incident-response-process/wp-content-uploads-2019-07-SSIRP-best-practices-headers_hu72b36f1b90d60f19ba86700a50132f62_74722_800x0_resize_q75_box.jpg)\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Preparation - Setup Incident Notification (IR-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-2-preparation---setup-incident-notification)\\r\\n\\r\\nEnsure the security alerts and incident notification from the cloud service provider's platform and your environments can be received by correct contact in your incident response organization.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Set the Microsoft Defender for Cloud Security Contact](https://docs.microsoft.com/azure/security-center/security-center-provide-security-contact-details)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Logic Apps](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IR.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type == \\\"microsoft.logic/workflows\\\"\\r\\n| extend Connection = parse_json(properties)[\\\"parameters\\\"][\\\"$connections\\\"][\\\"value\\\"]\\r\\n| where Connection has \\\"managedApis/azuresentinel\\\"\\r\\n| where id contains \\\"push\\\" or id contains \\\"send\\\" or id contains \\\"message\\\" or id contains \\\"text\\\" or id contains \\\"email\\\" or id contains \\\"notif\\\" or id contains \\\"team\\\" or id contains \\\"post\\\"\\r\\n| project id, type, resourceGroup\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Notification Playbooks Configured\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue startswith \\\"Microsoft.Logic\\\"\\r\\n| where ActivityStatusValue == \\\"Success\\\" or ActivityStatusValue == \\\"Succeeded\\\"\\r\\n| extend scope_ = tostring(Authorization_d.scope)\\r\\n| parse-where scope_ with * 'workflows/' PlaybookName '/' *\\r\\n| where PlaybookName contains \\\"notify\\\" or PlaybookName contains \\\"email\\\" or PlaybookName contains \\\"teams\\\" or PlaybookName contains \\\"ticket\\\" or PlaybookName contains \\\"post\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by PlaybookName\\r\\n| render timechart \",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Notification Playbooks Triggered over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 5 - Copy\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isIR2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Create Incidents Based on High-Quality Alerts (IR-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-3-detection-and-analysis---create-incidents-based-on-high-quality-alerts)\\r\\n\\r\\nEnsure you have a process to create high-quality alerts and measure the quality of alerts. This allows you to learn lessons from past incidents and prioritize alerts for analysts, so they don't waste time on false positives.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Export](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n💡 [How to Stream Alerts Into Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-azure-security-center)
\\r\\n💡 [Understand Security Coverage by the MITRE ATT&CK® Framework](https://docs.microsoft.com/azure/sentinel/mitre-coverage)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"IR.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true}},\"name\":\"query - 3\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"521d368e-c46e-41b5-bea0-fd07dc96b511\",\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Review Current MITRE Coverage >>\",\"style\":\"secondary\",\"bladeOpenContext\":{\"bladeName\":\"MitrePage.ReactView\",\"extensionName\":\"Microsoft_Azure_Security_Insights\"}}]},\"name\":\"links - 8\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Investigate an Incident (IR-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-4-detection-and-analysis---investigate-an-incident)\\r\\n\\r\\nEnsure security operation team can query and use diverse data sources as they investigate potential incidents, to build a full view of what happened. Diverse logs should be collected to track the activities of a potential attacker across the kill chain to avoid blind spots. You should also ensure insights and learnings are captured for other analysts and for future historical reference.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Snapshot a Windows Machine's Disk](https://docs.microsoft.com/azure/virtual-machines/windows/snapshot-copy-managed-disk)
\\r\\n💡 [Snapshot a Linux Machine's Disk](https://docs.microsoft.com/azure/virtual-machines/linux/snapshot-copy-managed-disk)
\\r\\n💡 [Microsoft Azure Support Diagnostic Information and Memory Dump Collection](https://azure.microsoft.com/support/legal/support-diagnostic-information-collection/)
\\r\\n💡 [Investigate Incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident \\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| where Severity == \\\"High\\\"\\r\\n| summarize count() by [\\\"Incident Name\\\"]=Title\\r\\n| sort by count_ desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"High Severity Incident Types\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident \\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| extend [\\\"MITRE ATT&CK® Tactics\\\"] = tostring(parse_json(tostring(AdditionalData.tactics))[0])\\r\\n| where [\\\"MITRE ATT&CK® Tactics\\\"] <> \\\"\\\"\\r\\n| summarize count() by [\\\"MITRE ATT&CK® Tactics\\\"]\\r\\n| sort by count_ desc\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"MITRE ATT&CK®Tactics Observed\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"InitialAccess\",\"color\":\"orange\"},{\"seriesName\":\"Exfiltration\",\"color\":\"orange\"},{\"seriesName\":\"Execution\",\"color\":\"orange\"},{\"seriesName\":\"PrivilegeEscalation\",\"color\":\"orange\"},{\"seriesName\":\"Persistence\",\"color\":\"orange\"},{\"seriesName\":\"DefenseEvasion\",\"color\":\"orange\"},{\"seriesName\":\"CredentialAccess\",\"color\":\"orange\"},{\"seriesName\":\"Discovery\",\"color\":\"orange\"},{\"seriesName\":\"Collection\",\"color\":\"orange\"},{\"seriesName\":\"Impact\",\"color\":\"orange\"},{\"seriesName\":\"Other\",\"color\":\"orange\"}]},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"customWidth\":\"50\",\"name\":\"query - 9\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Investigate Incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases) \\r\\n![Image Name](https://docs.microsoft.com/azure/sentinel/media/tutorial-investigate-cases/investigation-map.png)\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Detection & Analysis - Prioritize Incidents (IR-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-5-detection-and-analysis---prioritize-incidents)\\r\\n\\r\\nProvide context to security operations teams to help them determine which incidents ought to first be focused on, based on alert severity and asset sensitivity defined in your organization’s incident response plan. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Security Alerts in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-alerts-overview)
\\r\\n💡 [Use Tags to Organize Your Azure Resources](https://docs.microsoft.com/azure/azure-resource-manager/management/tag-resources)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) \"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| where Status <> \\\"Closed\\\"\\r\\n| summarize count() by Severity\\r\\n| render barchart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Open Incidents by Priority\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Informational\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\" Open Incidents by Priority\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Severity\\r\\n| render timechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Security Incident Severity Count over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}]},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Informational\",\"color\":\"gray\"}]}},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"🟦 Security Incident Priorities over Time\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Containment, Eradication & Recovery - Automate Incident Handling (IR-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-6-containment-eradication-and-recovery---automate-the-incident-handling)\\r\\n\\r\\nAutomate the manual, repetitive tasks to speed up response time and reduce the burden on analysts. Manual tasks take longer to execute, slowing each incident and reducing how many incidents an analyst can handle. Manual tasks also increase analyst fatigue, which increases the risk of human error that causes delays and degrades the ability of analysts to focus effectively on complex tasks. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Configure Workflow Automation in Security Center](https://docs.microsoft.com/azure/security-center/workflow-automation)
\\r\\n💡 [Setup Automated Threat Responses in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/tutorial-security-incident#triage-security-alerts)
\\r\\n💡 [Setup Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Logic Apps](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Logic%2Fworkflows)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type == \\\"microsoft.logic/workflows\\\"\\r\\n| extend Connection = parse_json(properties)[\\\"parameters\\\"][\\\"$connections\\\"][\\\"value\\\"]\\r\\n| where Connection has \\\"managedApis/azuresentinel\\\"\\r\\n| project id, type, resourceGroup\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Playbooks Configured\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue startswith \\\"Microsoft.Logic\\\"\\r\\n| where ActivityStatusValue == \\\"Success\\\" or ActivityStatusValue == \\\"Succeeded\\\"\\r\\n| extend scope_ = tostring(Authorization_d.scope)\\r\\n| parse-where scope_ with * 'workflows/' PlaybookName '/' *\\r\\n| where PlaybookName contains \\\"notify\\\" or PlaybookName contains \\\"email\\\" or PlaybookName contains \\\"teams\\\" or PlaybookName contains \\\"ticket\\\" or PlaybookName contains \\\"post\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by PlaybookName\\r\\n| render timechart\",\"size\":0,\"showAnalytics\":true,\"title\":\" Microsoft Sentinel (SOAR) Playbooks Triggered over Time\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Resource\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"uninitialized\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Post-Incident Activity - Conduct Lessons Learned & Retain Evidence (IR-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response#ir-7-post-incident-activity---conduct-lesson-learned-and-retain-evidence)\\r\\n\\r\\nConduct lesson learned in your organization periodically and/or after major incidents, to improve your future capability in incident response and handling. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Incident Response Process - Post-Incident Cleanup](https://docs.microsoft.com/security/compass/incident-response-process#2-post-incident-cleanup)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Incident Response/Resolution Times\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\n| extend Tactics = todynamic(AdditionalData.tactics)\\n| extend Owner = todynamic(Owner.assignedTo) \\n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber \\n| extend TimeToTriage = (FirstModifiedTime - CreatedTime)/1h\\n| where TimeToTriage <> 0\\n| summarize 50th_Percentile=percentile(TimeToTriage, 50) \\n\",\"size\":1,\"showAnalytics\":true,\"title\":\"Mean Time To Respond\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"50th_Percentile\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\n| where Status == \\\"Closed\\\"\\n| summarize arg_max(TimeGenerated,*) by IncidentNumber\\n| extend Tactics = todynamic(AdditionalData.tactics)\\n| extend Owner = todynamic(Owner.assignedTo) \\n| extend Product = todynamic((parse_json(tostring(AdditionalData.alertProductNames))[0])) \\n| extend TimeToClosure = (ClosedTime - CreatedTime)/1h\\n| where TimeToClosure <> 0\\n| summarize 50th_Percentile=percentile(TimeToClosure, 50)\",\"size\":1,\"showAnalytics\":true,\"title\":\"Mean Time To Resolve\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set.\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Classification\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"50th_Percentile\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":3}}},\"showBorder\":false,\"size\":\"auto\"}},\"customWidth\":\"50\",\"name\":\"query - 2\"}]},\"customWidth\":\"50\",\"name\":\"Incident Response/Resolution Times\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber\\r\\n| where Status == \\\"Closed\\\"\\r\\n| extend TimeToRespond = (CreatedTime - FirstActivityTime)/1d \\r\\n| extend TimeToResolve = (ClosedTime - CreatedTime)/1d\\r\\n| extend AssignedAnalyst = tostring(Owner.assignedTo)\\r\\n| extend [\\\"MITRE ATT&CK Tactics\\\"] = tostring(parse_json(tostring(AdditionalData.tactics))[0])\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, ClosedTime desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, [\\\"MITRE ATT&CK Tactics\\\"], AssignedAnalyst, Classification, ClassificationComment, ClassificationReason, Description, TimeToRespond, TimeToResolve, IncidentStartTime=CreatedTime, IncidentClosedTime=ClosedTime, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Incident Closure Reports\",\"noDataMessage\":\"No Incidents Observed Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Go to Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"TimeToRespond\",\"formatter\":0,\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"TimeToResolve\",\"formatter\":0,\"numberFormat\":{\"unit\":27,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"mapSettings\":{\"locInfo\":\"LatLong\",\"locInfoColumn\":\"Location\",\"latitude\":\"latitude_\",\"longitude\":\"longitude_\",\"sizeSettings\":\"city_\",\"sizeAggregation\":\"Count\",\"labelSettings\":\"city_\",\"legendMetric\":\"city_\",\"numberOfMetrics\":100,\"legendAggregation\":\"Count\",\"itemColorSettings\":{\"nodeColorField\":\"state_\",\"colorAggregation\":\"Count\",\"type\":\"heatmap\",\"heatmapPalette\":\"coldHot\"}}},\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isIR7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"IR-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isIRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Incident Response Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Posture & Vulnerability Management (PV)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)\\r\\n---\\r\\nPosture and Vulnerability Management focuses on controls for assessing and improving Azure security posture, including vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting, and correction in Azure resources. \"},\"customWidth\":\"40\",\"name\":\"PV Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Establish Secure Configurations (PV-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Audit & Enforce Secure Configurations (PV-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Establish Secure Configurations for Compute Resources (PV-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Audit & Enforce Secure Configurations for Compute Resources (PV-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"88da2310-858d-4451-a58a-ce067a466f15\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"e00258ef-49b5-4ac0-82d2-c67148d616d9\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9dfe4f44-10f2-4eb2-a98c-abd4a36b69a8\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Perform Vulnerability Assessments (PV-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Rapidly & Automatically Remediate Vulnerabilities (PV-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Regular Red Team Operations (PV-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"PV7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c12c9953-b31b-4d5d-b39d-8142caaa046b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"69a28041-108a-4881-bd8d-aabaa851fab6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7eec1f60-b3eb-45ea-81f5-64feb69dfb96\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isPV7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"PV7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Establish Secure Configurations (PV-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-1-define-and-establish-secure-configurations)\\r\\n\\r\\nDefine the secure configuration baselines for different resource types in the cloud. Alternatively, use configuration management tools to establish the configuration baseline automatically before or during resource deployment so the environment can be compliant by default after the deployment.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Illustration of Guardrails Implementation in Enterprise-Scale Landing Zone](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture#landing-zone-expanded-definition)
\\r\\n💡 [Working with Security Policies in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/tutorial-security-policy)
\\r\\n💡 [Tutorial: Create and manage policies to enforce compliance](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\\r\\n🔀 [Microsoft Defender for Cloud: Regulatory Compliance](https://ms.portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityRegulatoryCompliance\\r\\n| summarize count() by ComplianceStandard\\r\\n| sort by count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Regulatory Compliance Assessments by Standard Policy Checks\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Audit & Enforce Secure Configurations (PV-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-2-audit-and-enforce-secure-configurations)\\r\\n\\r\\nContinuously monitor and alert when there is a deviation from the defined configuration baseline. Enforce the desired configuration according to the baseline configuration by denying the non-compliant configuration or deploy a configuration. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Understand Azure Policy Effects](https://docs.microsoft.com/azure/governance/policy/concepts/effects)
\\r\\n💡 [Create and Manage Policies to Enforce Compliance](https://docs.microsoft.com/azure/governance/policy/tutorials/create-and-manage)
\\r\\n💡 [Get compliance data of Azure resources](https://docs.microsoft.com/azure/governance/policy/how-to/get-compliance-data)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Establish Secure Configurations for Compute Resources (PV-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-3-define-and-establish-secure-configurations-for-compute-resources)\\r\\n\\r\\nDefine the secure configuration baselines for your compute resources, such as VMs and containers. Use configuration management tools to establish the configuration baseline automatically before or during the compute resource deployment so the environment can be compliant by default after the deployment. Alternatively, use a pre-configured image to build the desired configuration baseline into the compute resource image template. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\\r\\n💡 [Linux OS security configuration baseline](https://docs.microsoft.com/azure/governance/policy/samples/guest-configuration-baseline-linux)
\\r\\n💡 [Windows OS security configuration baseline](https://docs.microsoft.com/azure/governance/policy/samples/guest-configuration-baseline-windows)
\\r\\n💡 [Security configuration recommendation for compute resources](https://docs.microsoft.com/azure/security-center/recommendations-reference)
\\r\\n💡 [Azure Automation State Configuration Overview](https://docs.microsoft.com/azure/automation/automation-dsc-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let FailedAssets=SecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| where AnalyzeResult == \\\"Failed\\\"\\r\\n| summarize FailedAssets = makelist(Computer) by Description;\\r\\nlet PassedAssets=SecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| where AnalyzeResult == \\\"Passed\\\"\\r\\n| summarize PassedAssets = makelist(Computer) by Description;\\r\\nSecurityBaseline\\r\\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\\r\\n| summarize\\r\\n Failed = countif(AnalyzeResult == \\\"Failed\\\"),\\r\\n Passed = countif(AnalyzeResult == \\\"Passed\\\"),\\r\\n Total = countif(AnalyzeResult == \\\"Failed\\\" or AnalyzeResult == \\\"Passed\\\")\\r\\n by Description\\r\\n| extend PassedControls = (Passed / todouble(Total)) * 100\\r\\n| join kind=fullouter(FailedAssets) on Description\\r\\n| join kind=fullouter(PassedAssets) on Description\\r\\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Configure Security Baselines\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Description\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Audit & Enforce Secure Configurations for Compute Resources (PV-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-4-audit-and-enforce-secure-configurations-for-compute-resources)\\r\\n\\r\\nContinuously monitor and alert when there is a deviation from the defined configuration baseline in your compute resources. Enforce the desired configuration according to the baseline configuration by denying the non-compliant configuration or deploy a configuration in compute resources. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [How to Create an Azure Virtual Machine from an ARM Template](https://docs.microsoft.com/azure/virtual-machines/windows/ps-template)
\\r\\n💡 [Azure Automation State Configuration Overview](https://docs.microsoft.com/azure/automation/automation-dsc-overview)
\\r\\n💡 [Create a Windows Virtual Machine in the Azure portal](https://docs.microsoft.com/azure/virtual-machines/windows/quick-create-portal)
\\r\\n💡 [Container Security in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/container-security)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.4\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Perform Vulnerability Assessments (PV-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-5-perform-vulnerability-assessments)\\r\\n\\r\\nPerform vulnerabilities assessment for your cloud resources at all tiers in a fixed schedule or on-demand. Track and compare the scan results to verify the vulnerabilities are remediated. The assessment should include all type of vulnerabilities, such as vulnerabilities in Azure services, network, web, operating systems, misconfigurations, and so on.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) 🔷 [SecurityNestedRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [Integrated Vulnerability Scanner for Virtual Machines](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [SQL Vulnerability Assessment](https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment)
\\r\\n💡 [Exporting Microsoft Defender for Cloud Vulnerability Scan Results](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-5\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.5\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityNestedRecommendation\\r\\n| where RecommendationState == \\\"Unhealthy\\\"\\r\\n| summarize count() by RecommendationName, RecommendationSeverity\\r\\n| sort by count_ desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" Patches, Updates & Vulnerabilities\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"Link_\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"RecommendationClick\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to Recommendation\"}},{\"columnMatch\":\"RecommendationLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n| where type == \\\"microsoft.security/assessments/subassessments\\\"\\r\\n| extend assessmentKey = extract(\\\".*assessments/(.+?)/.*\\\",1, id)\\r\\n| where assessmentKey == \\\"1195afff-c881-495e-9bc5-1486211ae03f\\\"\\r\\n | project Resource = tolower(extract(\\\"([\\\\\\\\s\\\\\\\\S]*?)(/providers/Microsoft.Security.*)\\\",1,id)), ResourceGroup = trim_end(\\\"/\\\",extract(\\\".*resourceGroups/(.+?)/\\\",0,id)), ResourceType = tolower(split(id,\\\"/\\\").[6]), subscriptionId, severity = tostring(parse_json(properties).status.severity), status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), description = tostring(parse_json(properties).displayName), patchable = parse_json(properties.additionalData).patchable, cve = parse_json(properties.additionalData).cve\\r\\n | where status == 'Unhealthy'\\r\\n | summarize dcount(VulnId) by ResourceGroup, Resource, severity, VulnId, description, tostring(patchable), tostring(cve)\\r\\n | summarize Total = count(dcount_VulnId), sevH=countif(severity=='High'), sevM=countif(severity=='Medium'), sevL=countif(severity=='Low'), patchAvailable = countif(patchable=='true'), CVEcount =countif(cve!='[]') by ResourceGroup, Resource\\r\\n | order by sevH desc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Vulnerability Scanning >> Select Asset for Details Below\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"exportFieldName\":\"Resource\",\"exportParameterName\":\"selectedServer\",\"exportDefaultValue\":\"All\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Subscription}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"$gen_group\",\"formatter\":13,\"formatOptions\":{\"linkColumn\":\"Resource\",\"linkTarget\":\"Resource\",\"showIcon\":true,\"customColumnWidthSetting\":\"30ch\"}},{\"columnMatch\":\"ResourceGroup\",\"formatter\":5},{\"columnMatch\":\"Resource\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"Total\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"10ch\"}},{\"columnMatch\":\"sevH\",\"formatter\":4,\"formatOptions\":{\"palette\":\"redBright\",\"customColumnWidthSetting\":\"12ch\"}},{\"columnMatch\":\"sevM\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellow\",\"customColumnWidthSetting\":\"13ch\"}},{\"columnMatch\":\"sevL\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blueDark\",\"customColumnWidthSetting\":\"10ch\"}},{\"columnMatch\":\"patchAvailable\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"pending\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"20ch\"}},{\"columnMatch\":\"CVEcount\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"4\",\"text\":\"{0}{1}\"}],\"customColumnWidthSetting\":\"10ch\"}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ResourceGroup\"],\"expandTopLevel\":true,\"finalBy\":\"Resource\"},\"labelSettings\":[{\"columnId\":\"ResourceGroup\",\"label\":\"Resource group\"},{\"columnId\":\"sevH\",\"label\":\"High\"},{\"columnId\":\"sevM\",\"label\":\"Medium\"},{\"columnId\":\"sevL\",\"label\":\"Low\"},{\"columnId\":\"patchAvailable\",\"label\":\"Available patches\"},{\"columnId\":\"CVEcount\",\"label\":\"CVEs\"}]}},\"customWidth\":\"50\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n| where type == \\\"microsoft.security/assessments/subassessments\\\"\\r\\n| extend assessmentKey = extract(\\\".*assessments/(.+?)/.*\\\",1, id)\\r\\n| where assessmentKey == \\\"1195afff-c881-495e-9bc5-1486211ae03f\\\"\\r\\n| project Resource = tolower(extract(\\\"([\\\\\\\\s\\\\\\\\S]*?)(/providers/Microsoft.Security.*)\\\",1,id)), ResourceGroup = trim_end(\\\"/\\\",extract(\\\".*resourceGroups/(.+?)/\\\",0,id)), ResourceType = tolower(split(id,\\\"/\\\").[6]), subscriptionId, Severity = tostring(parse_json(properties).status.severity), Status = tostring(parse_json(properties).status.code), VulnId = tostring(parse_json(properties).id), Description = tostring(parse_json(properties).displayName), Patchable = parse_json(properties.additionalData).patchable, CVE = properties.additionalData.cve, Category = tostring(properties.category), TimeGenerated = tostring(properties.timeGenerated), Remediation = tostring(properties.remediation), Impact = tostring(properties.impact), Threat = tostring(properties.additionalData.threat)\\r\\n| where Status == 'Unhealthy'\\r\\n| where '{selectedServer}' == 'All' or Resource == '{selectedServer}'\\r\\n| project Severity, VulnId, Description, tostring(Patchable), Category, Resource, ResourceGroup, CVE, TimeGenerated, Remediation, Impact, Threat\\r\\n| mv-expand CveExpand = split (CVE, \\\"},\\\") to typeof(string)\\r\\n| parse CveExpand with * '\\\"title\\\":\\\"' singleCve '\\\"' *\\r\\n| summarize CVEs = tostring(make_list(singleCve)) by Severity, VulnId, Description, tostring(Patchable), Category, Resource, ResourceGroup, TimeGenerated, Threat, Impact, Remediation\",\"size\":0,\"showAnalytics\":true,\"title\":\"Vulnerability Details >> Select Asset Above\",\"noDataMessage\":\"Select Asset in Vulnerability Scanning Panel Above\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":5},{\"columnMatch\":\"VulnId\",\"formatter\":5},{\"columnMatch\":\"Resource\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":6,\"formatOptions\":{\"customColumnWidthSetting\":\"25ch\"}},{\"columnMatch\":\"Remediation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"GenericDetails\",\"linkIsContextBlade\":true}}],\"rowLimit\":1000,\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"Severity\"],\"expandTopLevel\":true,\"finalBy\":\"VulnId\"},\"labelSettings\":[{\"columnId\":\"ResourceGroup\",\"label\":\"Resource group\"},{\"columnId\":\"TimeGenerated\",\"label\":\"Time generated\"}]}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Rapidly Automatically Remediate Vulnerabilities (PV-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-6-rapidly-and-automatically-remediate-vulnerabilities)\\r\\n\\r\\nRapidly and automatically deploy patches and updates to remediate vulnerabilities in your cloud resources. Use the appropriate risk-based approach to prioritize the remediation of the vulnerabilities. For example, more severe vulnerabilities in a higher value asset should be addressed as a higher priority. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Configure Update Management for Virtual Machines in Azure](https://docs.microsoft.com/azure/automation/update-management/overview)
\\r\\n💡 [Manage Updates and Patches for Your Azure VMs](https://docs.microsoft.com/azure/automation/update-management/manage-updates-for-vm)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"PV.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Conduct Regular Red Team Operations (PV-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management#pv-7-conduct-regular-red-team-operations)\\r\\n\\r\\nSimulate real-world attacks to provide a more complete view of your organization's vulnerability. Red team operations and penetration testing complement the traditional vulnerability scanning approach to discover risks.\\r\\n\\r\\n## Implementation\\r\\n💡 [Penetration Testing in Azure](https://docs.microsoft.com/azure/security/fundamentals/pen-testing)
\\r\\n💡 [Penetration Testing Rules of Engagement](https://www.microsoft.com/msrc/pentest-rules-of-engagement?rtc=1)
\\r\\n💡 [Microsoft Cloud Red Teaming](https://download.microsoft.com/download/C/1/9/C1990DBA-502F-4C2A-848D-392B93D9B9C3/Microsoft_Enterprise_Cloud_Red_Teaming.pdf)
\\r\\n💡 [Technical Guide to Information Security Testing and Assessment](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [SimuLand for Attack Simulation](https://www.microsoft.com/security/blog/2021/05/20/simuland-understand-adversary-tradecraft-and-improve-detection-strategies/)\\r\\n![Image Name](https://www.microsoft.com/security/blog/wp-content/uploads/2021/05/Map-of-threat-research.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Attack Simulator in the Security & Compliance Center](https://docs.microsoft.com/azure/automation/update-management/overview)\\r\\n![Image Name](https://docs.microsoft.com/microsoft-365/media/9bd65af4-1f9d-45c1-8c06-796d7ccfd425.jpg) \\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isPV7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"PV-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isPVVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Posture & Vulnerability Management\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Endpoint Security (ES)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security) \\r\\n---\\r\\nEndpoint Security covers controls in endpoint detection and response, including use of endpoint detection and response (EDR) and anti-malware service for endpoints in Azure environments. \"},\"customWidth\":\"40\",\"name\":\"ES Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Endpoint Detection & Response (ES-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Use Modern Anti-Malware Software (ES-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Anti-Malware Software/Signature Updates (ES-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"ES3\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"75f1caed-7990-4221-bcb9-084b788cec87\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isES3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"ES3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"3afd9d5a-2e29-476f-8508-478a4322a1a7\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Endpoint Detection & Response (ES-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-1-use-endpoint-detection-and-response-edr)\\r\\n\\r\\nEnable Endpoint Detection and Response (EDR) capabilities for VMs and integrate with SIEM and security operations processes.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Microsoft Defender for Cloud introduction](https://docs.microsoft.com/azure/security-center/defender-for-servers-introduction)
\\r\\n💡 [Microsoft Defender for Endpoint Overview](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
\\r\\n💡 [Microsoft Defender for Cloud feature coverage for machines](https://docs.microsoft.com/azure/security-center/security-center-services?tabs=features-windows)
\\r\\n💡 [Connector for Defender for servers integration into SIEM](https://docs.microsoft.com/azure/security-center/security-center-wdatp?WT.mc_id=Portal-Microsoft_Azure_Security_CloudNativeCompute&tabs=windows)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where RecommendationName contains \\\"endpoint protection\\\" or RecommendationName contains \\\"virus\\\" or RecommendationName contains \\\"defender for servers\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Description contains \\\"endpoint\\\" or Description contains \\\"EDR\\\" or Description contains \\\"virus\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: EDR\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Use Modern Anti-Malware Software (ES-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-2-use-modern-anti-malware-software)\\r\\n\\r\\nMicrosoft Defender for Cloud can automatically identify the use of a number of popular anti-malware solutions for your virtual machines and on-premises machines with Azure Arc configured, and report the endpoint protection running status and make recommendations.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Supported Endpoint Protection Solutions](https://docs.microsoft.com/azure/security-center/security-center-services?tabs=features-windows#supported-endpoint-protection-solutions-)
\\r\\n💡 [How to Configure Microsoft Antimalware for Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\\r\\n🔀 [Microsoft Sentinel](https://ms.portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"ES.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Title contains \\\"tool\\\" or Title contains \\\"mal\\\" or Title contains \\\"ware\\\" or Title contains \\\"mining\\\" or Title contains \\\"anti\\\" or Title contains \\\"exploit\\\" or Title contains \\\"inject\\\" or Title contains \\\"program\\\" or Title contains \\\"virus\\\" or Title contains \\\"worm\\\"\\r\\n| where Title !contains \\\"URL\\\"\\r\\n| where Title !contains \\\"net\\\"\\r\\n| where Title !contains \\\"web\\\"\\r\\n| where Title !contains \\\"normalization\\\"\\r\\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\\r\\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\\r\\n| extend SeverityRank=iff(Severity == \\\"High\\\", 3, iff(Severity == \\\"Medium\\\", 2, iff(Severity == \\\"Low\\\", 1, iff(Severity == \\\"Informational\\\", 0, 0))))\\r\\n| sort by SeverityRank, TimeGenerated desc\\r\\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Incidents: Malware\",\"noDataMessage\":\"No Incidents Observed For This Technique Within These Thresholds\",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Incident Name\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Alert\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"Sev0\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"Sev1\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"Sev2\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"Sev3\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"IncidentUrl\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Incident >>\",\"bladeOpenContext\":{\"bladeName\":\"CaseBlade\",\"extensionName\":\"Microsoft_Azure_Security_Insights\",\"bladeParameters\":[{\"name\":\"id\",\"source\":\"column\",\"value\":\"IncidentBlade\"}]}}},{\"columnMatch\":\"IncidentBlade\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Anti-Malware Software & Signatures are Updated (ES-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security#es-3-ensure-anti-malware-software-and-signatures-are-updated)\\r\\n\\r\\nEnsure anti-malware signatures are updated rapidly and consistently for the anti-malware solution.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) 🔷 [ProtectionStatus](https://docs.microsoft.com/azure/azure-monitor/reference/tables/protectionstatus) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Deploy Microsoft Antimalware for Azure Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\\r\\n💡 [Endpoint protection assessment and recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-endpoint-protection)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"ES.3\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ProtectionStatus\\r\\n| project ResourceId, OSName, SignatureVersion, ProtectionStatus, ProtectionStatusDetails, TypeofProtection, ScanDate\\r\\n| sort by ScanDate desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Protection Status\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ProtectionStatus\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"No real time protection\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Signatures out of date\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Real time protection\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Unknown\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Threat Detected\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Reporting\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"2\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"AlertLink\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\"}},{\"columnMatch\":\"CompromisedEntity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Account\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Entra ID Profile >>\"}},{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Fired\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"name\":\"query - 7 - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"isES3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"ES-3\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isESVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Endpoint Security Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Backup & Recovery (BR)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery) \\r\\n---\\r\\nBackup and Recovery covers controls to ensure that data and configuration backups at the different service tiers are performed, validated, and protected.\"},\"customWidth\":\"40\",\"name\":\"BR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Regular Automated Backups (BR-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Protect Backup & Recovery Data (BR-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Monitor Backups (BR-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Regularly Test Backups (BR-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"BR4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6ae2b31b-c2e7-4098-a83f-056deb37259e\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"c2825810-37fd-4aa3-810d-66a6fb91861b\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isBR4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"BR4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"9359e468-1457-462f-ba71-063894d31a58\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Regular Automated Backups (BR-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-1-ensure-regular-automated-backups)\\r\\n\\r\\nEnsure backup of business-critical resources, either during resource creation or enforced through policy for existing resources. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [How to Enable Azure Backup](https://learn.microsoft.com/en-us/azure/backup/)
\\r\\n💡 [Auto-Enable Backup on VM Creation using Azure Policy](https://docs.microsoft.com/azure/backup/backup-azure-auto-enable-backup)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"BR.1\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type contains \\\"recovery\\\"\\r\\n| project id,type,location,resourceGroup\\r\\n| order by location asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Recovery Services Vaults\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. \",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"warning\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"State\",\"formatter\":1},{\"columnMatch\":\"ControlID\",\"formatter\":1},{\"columnMatch\":\"Recommendation\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Go to Recommendation >\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Protect Backup & Recovery Data (BR-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-2-protect-backup-and-recovery-data)\\r\\n\\r\\nEnsure backup data and operations are protected from data exfiltration, data compromise, ransomware/malware and malicious insiders. The security controls that should be applied include user and network access control, data encryption at-rest and in-transit. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Overview of Security Features in Azure Backup](https://docs.microsoft.com/azure/backup/security-overview)
\\r\\n💡 [Encryption of Backup Data Using Customer-Managed Keys](https://docs.microsoft.com/azure/backup/encryption-at-rest-with-cmk)
\\r\\n💡 [Security features to help protect hybrid backups from attacks](https://docs.microsoft.com/azure/backup/backup-azure-security-feature#prevent-attacks)
\\r\\n💡 [Azure Backup - set cross region restore](https://docs.microsoft.com/azure/backup/backup-create-rs-vault#set-cross-region-restore)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview) \"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"BR.2\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Monitor Backups (BR-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-3-monitor-backups)\\r\\n\\r\\nEnsure all business-critical protectable resources are compliant with the defined backup policy and standard. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Govern your backup estate using Backup Center](https://docs.microsoft.com/azure/backup/backup-center-govern-environment)
\\r\\n💡 [Monitor and operate backups using Backup center](https://docs.microsoft.com/azure/backup/backup-center-monitor-operate)
\\r\\n💡 [Monitoring and reporting solutions for Azure Backup](https://docs.microsoft.com/azure/backup/monitoring-and-alerts-overview)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Center](https://portal.azure.com/#blade/Microsoft_Azure_DataProtection/BackupCenterMenuBlade/overview)\"},\"name\":\"BR-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue contains \\\"recovery\\\"\\r\\n| summarize count() by Caller\\r\\n| render piechart\",\"size\":0,\"showAnalytics\":true,\"title\":\"Users Interacting with Backups\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureActivity\\r\\n| where OperationNameValue contains \\\"recovery\\\"\\r\\n| project OperationName, Caller, OperationNameValue, ResourceId, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Backup Activity\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"OperationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Caller\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isBR3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Regularly Test Backups (BR-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery?WT.mc_id=Portal-fx#br-4-regularly-test-backup)\\r\\n\\r\\nPeriodically perform data recovery tests of your backup to verify that the backup configurations and availability of the backup data meets the recovery needs as per defined in the RTO (Recovery Time Objective) and RPO (Recovery Point Objective).\\r\\n\\r\\n## Implementation\\r\\n💡 [How to recover files from Azure Virtual Machine backup](https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm)
\\r\\n💡 [How to restore Key Vault keys in Azure](https://learn.microsoft.com/en-us/powershell/module/az.keyvault/restore-azkeyvaultkey)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\\r\\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Regularly test backups](https://docs.microsoft.com/azure/backup/backup-overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/backup/media/backup-overview/azure-backup-overview.png) \\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isBR4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-4\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isBRVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Backup & Recovery Group\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [DevOps Security (DS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security) \\r\\n---\\r\\nDevOps Security covers the controls related to the security engineering and operations in the DevOps processes, including deployment of critical security checks (such as static application security testing, vulnerability management) prior to the deployment phase to ensure the security throughout the DevOps process; it also includes common topics such as threat modeling and software supply security. \"},\"customWidth\":\"40\",\"name\":\"BR Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Conduct Threat Modeling (DS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Ensure Software Supply Chain Security (DS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Secure DevOps Infrastructure (DS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Integrate Static Application Security Testing into DevOps Pipeline (DS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS4\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"432231f5-e330-4608-a6f0-2586469caa56\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"3cae8cdf-ea83-4785-ae80-bd30a12bb879\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"bdbb6088-a8a5-42fe-a440-cb4b07c58f06\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Integrate Dynamic Application Security Testing into DevOps Pipeline (DS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS5\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enforce Security of Workload throughout DevOps Lifecycle (DS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Enable Logging & Monitoring in DevOps (DS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"DS7\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"448e20b4-58fd-4677-b2f4-3786a984351d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"8c41d5dc-518b-48b3-83df-2f6d065023a3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"263e3b56-f7f9-4c8d-b79e-5eb8c1c5f66a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isDS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"DS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Conduct Threat Modeling (DS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-1-conduct-threat-modeling)\\r\\n\\r\\nPerform threat modeling to identify the potential threats and enumerate the mitigating controls. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Threat Modeling Overview](https://www.microsoft.com/securityengineering/sdl/threatmodeling)
\\r\\n💡 [Application threat analysis (including STRIDE + questionnaire based method)](https://docs.microsoft.com/azure/architecture/framework/security/design-threat-model)
\\r\\n💡 [Azure Template - Microsoft Security Threat Model Stencil](https://github.com/AzureArchitecture/threat-model-templates)
\\r\\n💡 [Hunt for threats with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/hunting)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\\r\\n\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Getting started with the Threat Modeling Tool](https://docs.microsoft.com/azure/security/develop/threat-modeling-tool-getting-started)\\r\\n![Image Name](https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE2K1Za?ver=0327&q=90&m=8&h=450&w=800&b=%23FFFFFFFF&l=f&x=0&y=79&s=1709&d=961&aim=true)
\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityIncident\\r\\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\\r\\n| where Tactics <> \\\"[]\\\"\\r\\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Tactics\\r\\n| render timechart \\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"MITRE ATT&CK® Tactics Observed\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"name\":\"query - 1\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Ensure Software Supply Chain Security (DS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-2-ensure-software-supply-chain-security)\\r\\n\\r\\nEnsure your enterprise’s SDLC (Software Development Lifecycle) or process include a set of security controls to govern the in-house and third-party software components (including both proprietary and open-source software) where your applications have dependencies. Define gating criteria to prevent vulnerable or malicious components being integrated and deployed into the environment. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [GitHub Dependency Graph](https://docs.github.com/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph)
\\r\\n💡 [GitHub Dependabot](https://docs.github.com/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/about-dependabot-version-updates)
\\r\\n💡 [Identify vulnerable container images in your CI/CD workflows](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-cicd)
\\r\\n💡 [Azure DevOps Marketplace – supply chain security](https://marketplace.visualstudio.com/search?term=tag%3ASupply%20Chain%20Security&target=VSTS)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where RecommendationName contains \\\"contain\\\" or RecommendationName contains \\\"aks\\\" or RecommendationName contains \\\"kube\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Secure DevOps Infrastructure (DS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-3-secure-devops-infrastructure)\\r\\n\\r\\nEnsure the DevOps infrastructure and pipeline follow security best practices across environments including your build, test, and production stages.\\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [GitHubAuditLogPolling_CL](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github) 🔷 [AzureDevOpsAuditing](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [DevSecOps controls overview – secure pipelines](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
\\r\\n💡 [Secure your GitHub organization](https://docs.github.com/code-security/getting-started/securing-your-organization)
\\r\\n💡 [Azure DevOps pipeline – Microsoft hosted agent security considerations](https://docs.microsoft.com/azure/devops/pipelines/agents/hosted?view=azure-devops&preserve-view=true&tabs=yaml#security)
\\r\\n💡 [Protecting your GitHub assets with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721)
\\r\\n💡 [Deploy Microsoft Sentinel: Continuous Threat Monitoring for GitHub Solution](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github)
\\r\\n💡 [Azure DevOps - audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops&preserve-view=true)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditLogPolling_CL \\r\\n| project actor_s, org_s, repo_s, action_s, name_s, _document_id_s, visibility_s, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"GitHub Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"actor_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"action_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDevOpsAuditing\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Azure DevOps Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Integrate Static Application Security Testing into DevOps Pipeline (DS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-4-integrate-static-application-security-testing-into-devops-pipeline)\\r\\n\\r\\nEnsure static application security testing (SAST) is part of the gating controls in the CI/CD workflow. The gating can be set based on the testing results to prevent vulnerable packages from committing into the repository, building into the packages, or deploying into the production. \\r\\n\\r\\n## Implementation\\r\\n💡 [GitHub CodeQL](https://codeql.github.com/docs/)
\\r\\n💡 [BinSkim Binary Analyzer](https://github.com/microsoft/binskim)
\\r\\n💡 [Azure DevOps Credential Scan](https://secdevtools.azurewebsites.net/helpcredscan.html)
\\r\\n💡 [GitHub secret scanning](https://docs.github.com/code-security/secret-security/about-secret-scanning)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Getting started with Credential Scanner](https://secdevtools.azurewebsites.net/helpcredscan.html)\\r\\n![ImageName](https://secdevtools.azurewebsites.net/img/1_AddBuildTask.png)\"},\"customWidth\":\"50\",\"name\":\"text - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Integrate Dynamic Application Security Testing into DevOps Pipeline (DS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-5-integrate-dynamic-application-security-testing-into-devops-pipeline)\\r\\n\\r\\nEnsure dynamic application security testing (DAST) are part of the gating controls in the CI/CD workflow. The gating can be set based on the testing results to prevent vulnerability from building into the packages or deploying into the production. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityNestedRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [DAST tools in Azure DevOps marketplace](https://marketplace.visualstudio.com/search?term=DAST&target=AzureDevOps&category=All%20categories)
\\r\\n💡 [How to Implement Microsoft Defender for Cloud Vulnerability Assessment Recommendations](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [Integrated Vulnerability Scanner for Virtual Machines](https://docs.microsoft.com/azure/security-center/deploy-vulnerability-assessment-vm)
\\r\\n💡 [SQL Vulnerability Assessment](https://docs.microsoft.com/azure/azure-sql/database/sql-vulnerability-assessment)
\\r\\n💡 [Exporting Microsoft Defender for Cloud Vulnerability Scan Results](https://docs.microsoft.com/azure/security-center/continuous-export)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\\r\\n🔀 [Microsoft Defender XDR](https://security.microsoft.com/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityNestedRecommendation\\r\\n| extend CVE = tostring(parse_json(tostring(AdditionalData.Cve))[0].Title)\\r\\n| where Description <> \\\"\\\"\\r\\n| where Description <> \\\"N/A\\\"\\r\\n| summarize count() by Description, CVE\\r\\n| sort by count_ desc\\r\\n| project Description, CVE, count_\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\" System/Application Vulnerabilities\",\"noDataMessage\":\"Confirm ASC SecurityNestedRecommendation logging is enabled and/or extend time thresholds for a larger data-set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Description\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Execution\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"}},{\"columnMatch\":\"ComplianceDomain\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Persistence\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enforce Security of Workload throughout DevOps Lifecycle (DS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-6-enforce-security-of-workload-throughout-devops-lifecycle)\\r\\n\\r\\nEnsure the workload is secured throughout the entire lifecycle in development, testing, and deployment stage. Use Microsoft cloud security benchmark to evaluate the controls (such as network security, identity management, privileged access and so on) that can be set as guardrails by default or shift left prior to the deployment stage. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [SecurityRegulatoryCompliance](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityregulatorycompliance) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Shared Image Gallery overview](https://docs.microsoft.com/azure/virtual-machines/windows/shared-image-galleries)
\\r\\n💡 [How to implement Azure Defender for Cloud vulnerability assessment recommendations](https://docs.microsoft.com/azure/security-center/security-center-vulnerability-assessment-recommendations)
\\r\\n💡 [Security considerations for Azure Container](https://docs.microsoft.com/azure/container-instances/container-instances-image-security)
\\r\\n💡 [Azure Defender for container registries](https://docs.microsoft.com/azure/security-center/defender-for-container-registries-introduction)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | join kind = leftouter(\\r\\n securityresources\\r\\n | where type == \\\"microsoft.security/assessments\\\") on subscriptionId, name\\r\\n | extend complianceState = properties.state\\r\\n | extend resourceSource = tolower(tostring(properties1.resourceDetails.Source))\\r\\n | extend recommendationId = id1\\r\\n | extend resourceId = trim(' ', tolower(tostring(case(resourceSource =~ 'azure', properties1.resourceDetails.Id,\\r\\n resourceSource =~ 'gcp', properties1.resourceDetails.GcpResourceId,\\r\\n resourceSource =~ 'aws', properties1.resourceDetails.AwsResourceId,\\r\\n extract('^(.+)/providers/Microsoft.Security/assessments/.+$',1,recommendationId)))))\\r\\n | extend regexResourceId = extract_all(@\\\"/providers/[^/]+(?:/([^/]+)/[^/]+(?:/[^/]+/[^/]+)?)?/([^/]+)/([^/]+)$\\\", resourceId)[0]\\r\\n | extend resourceType = iff(regexResourceId[1] != \\\"\\\", regexResourceId[1], iff(regexResourceId[0] != \\\"\\\", regexResourceId[0], \\\"subscriptions\\\"))\\r\\n | extend resourceName = regexResourceId[2]\\r\\n | extend recommendationName = name\\r\\n | extend RecommendationName = properties1.displayName\\r\\n | extend description = properties1.metadata.description\\r\\n | extend remediationSteps = properties1.metadata.remediationDescription\\r\\n | extend severity = properties1.metadata.severity\\r\\n | extend state = properties1.status.code\\r\\n | extend notApplicableReason = properties1.status.cause\\r\\n | extend RecommendationLink = properties1.links.azurePortal\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | extend complianceControlId = extract(@\\\"/regulatoryComplianceControls/([^/]*)\\\", 1, id)\\r\\n | join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend controlName = tostring(properties.description)\\r\\n | project controlId = name, controlName\\r\\n | distinct *) on $right.controlId == $left.complianceControlId\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | summarize Failed = countif(state == \\\"Unhealthy\\\"), Passed = countif(state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\"), Total = countif(state == \\\"Unhealthy\\\" or state == \\\"Healthy\\\" or complianceState == \\\"Passed\\\") by RecommendationName, ControlID = controlId\\r\\n | extend PassedControls = (Passed/todouble(Total))*100\\r\\n| join kind = leftouter (securityresources\\r\\n | where type == \\\"microsoft.security/regulatorycompliancestandards/regulatorycompliancecontrols/regulatorycomplianceassessments\\\"\\r\\n | extend complianceStandardId = replace( \\\"-\\\", \\\" \\\", extract(@'/regulatoryComplianceStandards/([^/]*)', 1, id))\\r\\n | where complianceStandardId == \\\"Microsoft cloud security benchmark\\\"\\r\\n | extend RecommendationName = tostring(properties.description)\\r\\n | extend RecommendationLink = tostring(properties.assessmentDetailsLink)\\r\\n | project RecommendationName, RecommendationLink, name) on RecommendationName \\r\\n| extend Remediate=RecommendationLink\\r\\n| where ControlID == \\\"DS.6\\\"\\r\\n| parse Remediate with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\\r\\n| distinct RecommendationName, Total, Remediate, PassedControls, Passed, Failed, assessmentKey\\r\\n| sort by Total, Passed desc\\r\\n| limit 250\",\"size\":0,\"showAnalytics\":true,\"title\":\"Security Policy Recommendations \",\"noDataMessage\":\"No Recommendations Observed Within These Thresholds. Confirm the Microsoft Defender for Cloud: Regulatory Compliance Initiative for Microsoft cloud security benchmark is Enabled\",\"showExportToExcel\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"[\\\"Passed\\\"]/[\\\"Total\\\"]\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"Remediate\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"Remediate >>\",\"bladeOpenContext\":{\"bladeName\":\"RecommendationsBlade\",\"extensionName\":\"Microsoft_Azure_Security\",\"bladeParameters\":[{\"name\":\"assessmentKey\",\"source\":\"column\",\"value\":\"assessmentKey\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumFractionDigits\":2}}},{\"columnMatch\":\"Passed\",\"formatter\":5},{\"columnMatch\":\"Failed\",\"formatter\":5},{\"columnMatch\":\"assessmentKey\",\"formatter\":5}],\"filter\":true},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Failed\",\"color\":\"redBright\"},{\"seriesName\":\"Passed\",\"color\":\"green\"}]}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Enable Logging and Monitoring in DevOps (DS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security#ds-7-enable-logging-and-monitoring-in-devops)\\r\\n\\r\\nEnsure your logging and monitoring scope includes non-production environments and CI/CD workflow elements used in DevOps (and any other development processes). The vulnerabilities and threats targeting these environments can introduce significant risks to your production environment if they are not monitored properly. The events from the CI/CD build, test and deployment workflow should also be monitored to identify any deviations in the CI/CD workflow jobs. \\r\\n\\r\\n## Recommended Logs\\r\\n🔷 [GitHubAuditLogPolling_CL](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github) 🔷 [AzureDevOpsAuditing](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\\r\\n\\r\\n## Implementation\\r\\n💡 [Azure DevOps - audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops&preserve-view=true)
\\r\\n💡 [GitHub logging](https://docs.github.com/organizations/keeping-your-organization-secure/reviewing-the-audit-log-for-your-organization)
\\r\\n💡 [Protecting your GitHub assets with Microsoft Sentinel](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/protecting-your-github-assets-with-azure-sentinel/ba-p/1457721)
\\r\\n💡 [Deploy Microsoft Sentinel: Continuous Threat Monitoring for GitHub Solution](https://portal.azure.com/#create/microsoftcorporation1622712991604.sentinel4githubsentinel4github)
\\r\\n\\r\\n## Microsoft Portals\\r\\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\\r\\n🔀 [GitHub](https://github.com/)
\\r\\n🔀 [Azure DevOps](https://azure.microsoft.com/services/devops/)
\"},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"BR-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"## 💡[Enable Azure DevOps Audit streaming](https://docs.microsoft.com/azure/devops/organizations/audit/auditing-streaming?view=azure-devops)\\r\\n![Image](https://docs.microsoft.com/azure/devops/organizations/audit/media/auditing-streaming/create-new-auditing-stream.png?view=azure-devops)\"},\"customWidth\":\"50\",\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"GitHubAuditLogPolling_CL \\r\\n| project actor_s, org_s, repo_s, action_s, name_s, _document_id_s, visibility_s, TimeGenerated\\r\\n| sort by TimeGenerated desc\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"GitHub Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"actor_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Person\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"action_s\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"AzureDevOpsAuditing\\r\\n| limit 250\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Azure DevOps Audit Logs\",\"noDataMessage\":\"An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. \",\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{Workspace}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"RecommendationDisplayName\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"Gear\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Total\",\"formatter\":22,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"Passed\",\"color\":\"green\"},{\"columnName\":\"Failed\",\"color\":\"redBright\"}]}}},{\"columnMatch\":\"PassedControls\",\"formatter\":0,\"numberFormat\":{\"unit\":1,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2}}},{\"columnMatch\":\"ControlNumber\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"AllServices\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"RecommendationState\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"!=\",\"thresholdValue\":\"Healthy\",\"representation\":\"3\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"success\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"isDS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DS-7\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isDSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"DevOps Security\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Governance & Strategy (GS)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy) \\r\\n---\\r\\nGovernance and Strategy provides guidance for ensuring a coherent security strategy and documented governance approach to guide and sustain security assurance, including establishing roles and responsibilities for the different cloud security functions, unified technical strategy, and supporting policies and standards. \"},\"customWidth\":\"40\",\"name\":\"GS Guide\"},{\"type\":1,\"content\":{\"json\":\"\"},\"customWidth\":\"60\",\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Align Organization Roles & Responsibilities (GS-1)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS1.\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define Enterprise Segmentation Strategy (GS-2)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS2\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Data Protection Strategy (GS-3)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS3\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Network Security Strategy (GS-4)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS4\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement security Posture Management Strategy (GS-5)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS5\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a206a547-329b-4003-8832-c16daacca6c6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS1Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS1.\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS2Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS2\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"bf30d754-c4b6-463d-9683-751c1d04c6be\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS3Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS3\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"faf2c7d2-4fba-42cb-b2af-46acfb3e86af\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS4Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS4\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"6ce04d53-ba6b-4798-98ac-5e187cefa6ee\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS5Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS5\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000},\"id\":\"ed6784f0-b512-4d1f-bfdf-716b7cb92ca0\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"[\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Identity Strategy (GS-6)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS6\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Logging & IR Strategy (GS-7)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS7\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Backup & Recovery Strategy (GS-8)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS8\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement Endpoint Security Strategy (GS-9)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS9\\\\\\\" },\\\\r\\\\n\\\\t{ \\\\\\\"Control\\\\\\\": \\\\\\\"Define & Implement DevOps Security Strategy (GS-10)\\\\\\\", \\\\\\\"tab\\\\\\\": \\\\\\\"GS10\\\\\\\" }\\\\r\\\\n]\\\"}\\r\\n\",\"size\":3,\"exportMultipleValues\":true,\"exportedParameters\":[{\"fieldName\":\"tab\",\"parameterName\":\"Tab\",\"parameterType\":1}],\"queryType\":8,\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Control\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"tab\",\"formatter\":5}]}},\"customWidth\":\"40\",\"name\":\"query - 8 - Copy\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"74a2acdf-58b1-4894-9751-df3d37c60c0a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS6Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS6\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"430132bd-1307-4751-9e7c-d8e5d4c35a60\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS7Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS7\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"60452be3-bb0d-46b6-8b64-a0dd85f8c184\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS8Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS8\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"ab4776ea-1780-4461-b79e-0158cd70dcfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS9Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS9\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"7b8c13cd-cea6-40ff-b96d-f533b1cadd04\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"isGS10Visible\",\"type\":1,\"isHiddenWhenLocked\":true,\"criteriaData\":[{\"criteriaContext\":{\"leftOperand\":\"Tab\",\"operator\":\"contains\",\"rightValType\":\"static\",\"rightVal\":\"GS10\",\"resultValType\":\"static\",\"resultVal\":\"true\"}},{\"criteriaContext\":{\"operator\":\"Default\",\"rightValType\":\"param\",\"resultValType\":\"static\",\"resultVal\":\"false\"}}],\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"10\",\"name\":\"Hidden Parameters Selectors - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Align Organization Roles, Responsibilities & Accountabilities (GS-1)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-1-align-organization-roles-responsibilities-and-accountabilities)\\r\\n\\r\\nEnsure that you define and communicate a clear strategy for roles and responsibilities in your security organization. Prioritize providing clear accountability for security decisions, educating everyone on the shared responsibility model, and educate technical teams on technology to secure the cloud.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Best Practice 1 – People: Educate Teams on Cloud Security Journey](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#1-people-educate-teams-about-the-cloud-security-journey)
\\r\\n💡 [Azure Security Best Practice 2 - People: Educate Teams on Cloud Security Technology](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#2-people-educate-teams-on-cloud-security-technology)
\\r\\n💡 [Azure Security Best Practice 3 - Process: Assign Accountability for Cloud Security Decisions](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#4-process-update-incident-response-ir-processes-for-cloud)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-1\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Align Organization Roles, Responsibilities, and Accountabilities](https://docs.microsoft.com/security/zero-trust/identity)\\r\\n![Image Name](https://docs.microsoft.com/azure/role-based-access-control/media/rbac-and-directory-admin-roles/rbac-admin-roles.png)\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS1\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS1Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-1\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [GS-2: Define & Implement Enterprise Segmentation/Separation of Duties Strategy (GS-2)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-2-define-and-implement-enterprise-segmentationseparation-of-duties-strategy)\\r\\n\\r\\nEstablish an enterprise-wide strategy to segment access to assets using a combination of identity, network, application, subscription, management group, and other controls.\\r\\n\\r\\n## Strategy\\r\\n💡 [Security in the Microsoft Cloud Adoption Framework for Azure - Segmentation: Separate to Protect](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/access-control#segmentation-separate-to-protect)
\\r\\n💡 [Security in the Microsoft Cloud Adoption Framework for Azure - Architecture: Establish Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-2\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Segment and Enforce the External Boundaries](https://docs.microsoft.com/security/zero-trust/networks#segment-and-enforce-the-external-boundaries)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-servers-devices-boundaries-azure-vpn.png) \\r\\n\\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS2\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS2Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-2\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Data Protection Strategy (GS-3)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-3-define-and-implement-data-protection-strategy)\\r\\n\\r\\nEstablish an enterprise-wide strategy for data protection in Azure\\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Data Protection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-data-protection)
\\r\\n💡 [Cloud Adoption Framework - Azure data security and encryption best practices](https://docs.microsoft.com/azure/security/fundamentals/data-encryption-best-practices)
\\r\\n💡 [Azure Security Fundamentals - Azure Data security, encryption, and storage](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview)
\"},\"name\":\"GS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Asset Management and Data Protection Strategy](https://docs.microsoft.com/security/zero-trust/data)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-monitor-remediate-data.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS1\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS3Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-3\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Network Security Strategy (GS-4)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-4-define-and-implement-network-security-strategy)\\r\\n\\r\\nEstablish an Azure network security strategy as part of your organization's overall security strategy for access control.\\r\\n\\r\\n## Strategy\\r\\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\\r\\n💡 [Microsoft cloud security benchmark - Network Security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-network-security)
\\r\\n💡 [Azure Network Security Overview](https://docs.microsoft.com/azure/security/fundamentals/network-overview)
\\r\\n💡 [Enterprise Network Architecture Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/architecture)
\"},\"name\":\"GS-4\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Network Security Strategy](https://docs.microsoft.com/security/zero-trust/networks)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-azure-region-virtual-network-servers.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS5\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS4Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-4\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Security Posture Management Strategy (GS-5)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-5-define-and-implement-security-posture-management-strategy)\\r\\n\\r\\nEstablish a policy, procedure and standard to ensure the security configuration management and vulnerability management are in place in your cloud security mandate.\\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Posture and Vulnerability Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-posture-vulnerability-management)
\\r\\n💡 [Azure Security Best Practice 9 - Establish security posture management](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/security-top-10#5-process-establish-security-posture-management)
\"},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-3\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Security Posture Management Strategy](https://docs.microsoft.com/security/zero-trust/visibility-automation-orchestration)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-provide-integrated-capabilities-manage-threats.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS3\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS5Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-5\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Identity & Privileged Access Strategy (GS-6)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-6-define-and-implement-identity-and-privileged-access-strategy)\\r\\n\\r\\nEstablish an Azure identity and privileged access approach as part of your organization's overall security access control strategy. \\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Identity Management](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-identity-management)
\\r\\n💡 [Microsoft cloud security benchmark - Privileged Access](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-privileged-access)
\\r\\n💡 [Azure Security Best Practice 11 - Architecture. Single Unified Security Strategy](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#11-architecture-establish-a-single-unified-security-strategy)
\\r\\n💡 [Azure Identity Management Security Overview](https://docs.microsoft.com/azure/security/fundamentals/identity-management-overview)
\"},\"name\":\"GS-6\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Identity and Privileged Access Strategy](https://docs.microsoft.com/security/zero-trust/identity)\\r\\n![Image Name](https://docs.microsoft.com/security/zero-trust/media/diagram-conditional-access-policies.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS6\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS6Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-6\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Logging, Threat Detection & Incident Response Strategy (GS-7)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-7-define-and-implement-logging-threat-detection-and-incident-response-strategy)\\r\\n\\r\\nEstablish a logging, threat detection and incident response strategy to rapidly detect and remediate threats and meeting compliance requirements. Security operations (SecOps / SOC) team should prioritize high quality alerts and seamless experiences so that they can focus on threats rather than log integration and manual steps.\\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Logging and Threat Detection](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-logging-threat-detection)
\\r\\n💡 [Microsoft cloud security benchmark - Incident Response](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-incident-response)
\\r\\n💡 [Azure Security Best Practice 4 - Process. Update Incident Response Processes for Cloud](https://docs.microsoft.com/azure/cloud-adoption-framework/security/security-top-10#3-process-assign-accountability-for-cloud-security-decisions)
\\r\\n💡 [Azure Adoption Framework, Logging, and Reporting Decision Guide](https://docs.microsoft.com/azure/cloud-adoption-framework/decision-guides/logging-and-reporting/)
\\r\\n💡 [Azure Enterprise Scale, Management, and Monitoring](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/management-and-monitoring)
\"},\"name\":\"GS-7\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Logging and Threat Response Strategy](https://docs.microsoft.com/azure/sentinel/overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/sentinel/media/overview/core-capabilities.png) \\r\\n\"},\"customWidth\":\"35\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS7\",\"styleSettings\":{\"maxWidth\":\"35\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS7Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-7\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Backup & Recovery Strategy (GS-8)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-8-define-and-implement-backup-and-recovery-strategy)\\r\\n\\r\\nEstablish an Azure backup and recovery strategy for your organization. \\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Backup and Recovery](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-backup-recovery)
\\r\\n💡 [Azure Well-Architecture Framework - Backup and Disaster Recover for Azure Applications](https://docs.microsoft.com/azure/architecture/framework/resiliency/backup-and-recovery)
\\r\\n💡 [Azure Adoption Framework - Business Continuity and Disaster Recovery](https://docs.microsoft.com/azure/cloud-adoption-framework/ready/enterprise-scale/business-continuity-and-disaster-recovery)
\\r\\n💡 [Backup and restore plan to protect against ransomware](https://docs.microsoft.com/azure/security/fundamentals/backup-plan-to-protect-against-ransomware)
\"},\"name\":\"GS-8\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Backup and Recovery Strategy](https://docs.microsoft.com/azure/backup/backup-overview)\\r\\n![Image Name](https://docs.microsoft.com/azure/backup/media/backup-overview/azure-backup-overview.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS8Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement Endpoint Security Strategy (GS-9)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-9-define-and-implement-endpoint-security-strategy)\\r\\n\\r\\nEstablish a cloud endpoint security strategy.\\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - Endpoint security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)
\\r\\n💡 [Best practices for endpoint security on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-endpoints)
\"},\"name\":\"GS-9\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define Endpoint Security Strategy](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-endpoint-security)\\r\\n![Image Name](https://docs.microsoft.com/microsoft-365/media/mde-p1/mde-p1-overview-diagram.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS9Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-9\",\"styleSettings\":{\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# [Define & Implement DevOps Security Strategy (GS-10)](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-governance-strategy#gs-10-define-and-implement-devops-security-strategy)\\r\\n\\r\\nMandate the security controls as part of the organization's DevOps engineering and operation standard. Define the security objectives, control requirements, and tooling specifications in accordance with enterprise and cloud security standards in your organization.\\r\\n\\r\\n## Strategy\\r\\n💡 [Microsoft cloud security benchmark - DevOps security](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security)
\\r\\n💡 [Secure DevOps](https://www.microsoft.com/securityengineering/devsecops)
\\r\\n💡 [Cloud Adoption Framework - DevSecOps controls](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/devsecops-controls)
\"},\"name\":\"GS-10\"},{\"type\":1,\"content\":{\"json\":\"## Control Assessment\\r\\n\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"52668f65-b44a-4e14-82d8-c87410e7e5dc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationStatus\",\"label\":\"Implementation Status\",\"type\":2,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Not Implemented\\\", \\\"label\\\": \\\"Not Implemented\\\", \\\"selected\\\":true},\\r\\n {\\\"value\\\": \\\"Implemented\\\", \\\"label\\\": \\\"Implemented\\\"},\\r\\n {\\\"value\\\": \\\"Alternate Implementation\\\", \\\"label\\\": \\\"Alternate Implementation\\\"},\\r\\n {\\\"value\\\": \\\"Planned\\\", \\\"label\\\": \\\"Planned\\\"},\\r\\n {\\\"value\\\": \\\"Out of Scope\\\", \\\"label\\\": \\\"Out of Scope\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Implemented\"},{\"id\":\"578b8620-30b9-4b92-abc6-997998bc8156\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ImplementationDate\",\"label\":\"Implementation Date\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000}},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Notes\",\"type\":1,\"value\":\"\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"7bd0d384-d3c3-4c77-9dae-d75e823edfcf\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Status\"},{\"type\":1,\"content\":{\"json\":\"## Notes
\\r\\n{Notes}\"},\"name\":\"text - 1\"}]},\"customWidth\":\"50\",\"name\":\"group - 2\"},{\"type\":1,\"content\":{\"json\":\"### 💡 [Define and implement DevOps security strategy](https://docs.microsoft.com/security/benchmark/azure/security-controls-v3-devops-security?WT.mc_id=Portal-fx)\\r\\n![Image Name](https://docs.microsoft.com/azure/cloud-adoption-framework/secure/media/devsecops-controls.png) \\r\\n\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS8\",\"styleSettings\":{\"maxWidth\":\"50\"}}]},\"conditionalVisibility\":{\"parameterName\":\"isGS10Visible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"GS-10\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"isGSVisible\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"Governance & Strategy Group\"}],\"fromTemplateId\":\"sentinel-AzureSecurityBenchmark\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -993,7 +992,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.3", + "version": "3.0.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "AzureSecurityBenchmark", @@ -1066,4 +1065,4 @@ } ], "outputs": {} -} +} \ No newline at end of file diff --git a/Solutions/AzureSecurityBenchmark/ReleaseNotes.md b/Solutions/AzureSecurityBenchmark/ReleaseNotes.md index d3b3543e822..48465101329 100644 --- a/Solutions/AzureSecurityBenchmark/ReleaseNotes.md +++ b/Solutions/AzureSecurityBenchmark/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|----------------------------------------------------------------------------| +| 3.0.4 | 10-04-2026 | Updated Azure Security Benchmark label and queries. | | 3.0.3 | 10-09-2025 | Removed the network map from the workbook. | | 3.0.2 | 12-04-2024 | Updated Entity Mappings | | 3.0.1 | 24-01-2023 | Updated the solution to fix **Analytic Rules** deployment issue | diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 0062cd38249..475d2495b45 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -10359,6 +10359,8 @@ "templateRelativePath": "NetskopeWebTx_Workbook.json", "subtitle": "Web Traffic Analysis and Security Monitoring", "provider": "Netskope" +}, +{ "workbookKey": "MicrosoftCopilotActivityMonitoring", "logoFileName": "Copilot_logo.svg", "description": "Microsoft Copilot Activity Monitoring.",