Skip to content

Commit 8fad560

Browse files
v-atulyadavv-atulyadav
authored
Merge pull request Azure#12803 from samikroy/patch-57
Adding new workbook for Auth0
2 parents 2acf72b + 1e438f0 commit 8fad560

4 files changed

Lines changed: 425 additions & 1 deletion

File tree

‎Workbooks/Auth0Workbook.json‎

Lines changed: 399 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,399 @@
1+
{
2+
"version": "Notebook/1.0",
3+
"items": [
4+
{
5+
"type": 9,
6+
"content": {
7+
"version": "KqlParameterItem/1.0",
8+
"parameters": [
9+
{
10+
"id": "adc91142-7242-43b1-845d-03706394c2fa",
11+
"version": "KqlParameterItem/1.0",
12+
"name": "TimeGenerated",
13+
"type": 4,
14+
"typeSettings": {
15+
"selectableValues": [
16+
{
17+
"durationMs": 300000
18+
},
19+
{
20+
"durationMs": 900000
21+
},
22+
{
23+
"durationMs": 1800000
24+
},
25+
{
26+
"durationMs": 3600000
27+
},
28+
{
29+
"durationMs": 14400000
30+
},
31+
{
32+
"durationMs": 43200000
33+
},
34+
{
35+
"durationMs": 86400000
36+
},
37+
{
38+
"durationMs": 172800000
39+
},
40+
{
41+
"durationMs": 259200000
42+
},
43+
{
44+
"durationMs": 604800000
45+
},
46+
{
47+
"durationMs": 1209600000
48+
},
49+
{
50+
"durationMs": 2419200000
51+
},
52+
{
53+
"durationMs": 2592000000
54+
},
55+
{
56+
"durationMs": 5184000000
57+
},
58+
{
59+
"durationMs": 7776000000
60+
}
61+
]
62+
},
63+
"timeContext": {
64+
"durationMs": 86400000
65+
},
66+
"value": {
67+
"durationMs": 86400000
68+
}
69+
}
70+
],
71+
"style": "pills",
72+
"queryType": 0,
73+
"resourceType": "microsoft.operationalinsights/workspaces"
74+
},
75+
"name": "parameters - 0"
76+
},
77+
{
78+
"type": 3,
79+
"content": {
80+
"version": "KqlItem/1.0",
81+
"query": "Auth0Logs_CL\n| extend DeviceType = iff(IsMobile, \"Mobile\", \"Desktop/Other\")\n| summarize EventCount = count() by DeviceType\n",
82+
"size": 4,
83+
"title": "Mobile Traffic Distribution",
84+
"timeContextFromParameter": "TimeGenerated",
85+
"showRefreshButton": true,
86+
"showExportToExcel": true,
87+
"queryType": 0,
88+
"resourceType": "microsoft.operationalinsights/workspaces",
89+
"visualization": "piechart",
90+
"chartSettings": {
91+
"showMetrics": false,
92+
"showLegend": true
93+
}
94+
},
95+
"customWidth": "20",
96+
"name": "Mobile Traffic Distribution"
97+
},
98+
{
99+
"type": 3,
100+
"content": {
101+
"version": "KqlItem/1.0",
102+
"query": "Auth0Logs_CL\n| summarize Count = count() by EventType\n",
103+
"size": 4,
104+
"title": "Event Types Distribution",
105+
"timeContextFromParameter": "TimeGenerated",
106+
"showRefreshButton": true,
107+
"showExportToExcel": true,
108+
"queryType": 0,
109+
"resourceType": "microsoft.operationalinsights/workspaces",
110+
"visualization": "piechart",
111+
"chartSettings": {
112+
"showMetrics": false,
113+
"showLegend": true
114+
}
115+
},
116+
"customWidth": "20",
117+
"name": "Event Types Distribution"
118+
},
119+
{
120+
"type": 3,
121+
"content": {
122+
"version": "KqlItem/1.0",
123+
"query": "Auth0Logs_CL\n| summarize Events = count() by SrcHostname\n| top 8 by Events desc\n",
124+
"size": 4,
125+
"title": "Device Hostname Distribution",
126+
"timeContextFromParameter": "TimeGenerated",
127+
"showRefreshButton": true,
128+
"showExportToExcel": true,
129+
"queryType": 0,
130+
"resourceType": "microsoft.operationalinsights/workspaces",
131+
"visualization": "piechart",
132+
"chartSettings": {
133+
"showMetrics": false,
134+
"showLegend": true
135+
}
136+
},
137+
"customWidth": "20",
138+
"name": "Device Hostname Distribution"
139+
},
140+
{
141+
"type": 3,
142+
"content": {
143+
"version": "KqlItem/1.0",
144+
"query": "Auth0Logs_CL\n| extend ScopeSensitivity = case(\n Scope startswith \"delete\", \"High Privilege\",\n Scope startswith \"update\", \"Medium Privilege\",\n Scope startswith \"create\", \"Low Privilege\",\n Scope startswith \"read\", \"Read-Only\",\n \"Other\"\n)\n| summarize EventCount = count() by ScopeSensitivity\n",
145+
"size": 4,
146+
"title": "Scope Sensitivity Split",
147+
"timeContextFromParameter": "TimeGenerated",
148+
"showRefreshButton": true,
149+
"showExportToExcel": true,
150+
"queryType": 0,
151+
"resourceType": "microsoft.operationalinsights/workspaces",
152+
"visualization": "piechart",
153+
"chartSettings": {
154+
"showMetrics": false,
155+
"showLegend": true
156+
}
157+
},
158+
"customWidth": "20",
159+
"name": "Scope Sensitivity Split"
160+
},
161+
{
162+
"type": 3,
163+
"content": {
164+
"version": "KqlItem/1.0",
165+
"query": "Auth0Logs_CL\n| extend Domain = extract(@\"https?://([^/]+)\", 1, Audience)\n| summarize EventCount = count() by Domain\n| top 10 by EventCount\n",
166+
"size": 4,
167+
"title": "Access Target Domains",
168+
"timeContext": {
169+
"durationMs": 86400000
170+
},
171+
"showRefreshButton": true,
172+
"showExportToExcel": true,
173+
"queryType": 0,
174+
"resourceType": "microsoft.operationalinsights/workspaces",
175+
"visualization": "piechart",
176+
"chartSettings": {
177+
"showMetrics": false,
178+
"showLegend": true
179+
}
180+
},
181+
"customWidth": "20",
182+
"name": "Access Target Domains"
183+
},
184+
{
185+
"type": 3,
186+
"content": {
187+
"version": "KqlItem/1.0",
188+
"query": "Auth0Logs_CL\n| summarize EventCount = count() by ClientName\n| top 10 by EventCount desc\n",
189+
"size": 0,
190+
"title": "Client Applications by Usage",
191+
"timeContextFromParameter": "TimeGenerated",
192+
"showRefreshButton": true,
193+
"showExportToExcel": true,
194+
"queryType": 0,
195+
"resourceType": "microsoft.operationalinsights/workspaces",
196+
"visualization": "barchart",
197+
"tileSettings": {
198+
"showBorder": false,
199+
"titleContent": {
200+
"columnMatch": "ClientName",
201+
"formatter": 1
202+
},
203+
"leftContent": {
204+
"columnMatch": "EventCount",
205+
"formatter": 12,
206+
"formatOptions": {
207+
"palette": "auto"
208+
},
209+
"numberFormat": {
210+
"unit": 17,
211+
"options": {
212+
"maximumSignificantDigits": 3,
213+
"maximumFractionDigits": 2
214+
}
215+
}
216+
}
217+
},
218+
"graphSettings": {
219+
"type": 0,
220+
"topContent": {
221+
"columnMatch": "ClientName",
222+
"formatter": 1
223+
},
224+
"centerContent": {
225+
"columnMatch": "EventCount",
226+
"formatter": 1,
227+
"numberFormat": {
228+
"unit": 17,
229+
"options": {
230+
"maximumSignificantDigits": 3,
231+
"maximumFractionDigits": 2
232+
}
233+
}
234+
}
235+
}
236+
},
237+
"name": "Client Applications by Usage"
238+
},
239+
{
240+
"type": 3,
241+
"content": {
242+
"version": "KqlItem/1.0",
243+
"query": "Auth0Logs_CL\n| summarize EventsGenerated = count() by ActorUsername\n| top 10 by EventsGenerated desc\n",
244+
"size": 0,
245+
"title": "Most Active Users",
246+
"timeContextFromParameter": "TimeGenerated",
247+
"showRefreshButton": true,
248+
"showExportToExcel": true,
249+
"queryType": 0,
250+
"resourceType": "microsoft.operationalinsights/workspaces",
251+
"visualization": "barchart",
252+
"tileSettings": {
253+
"titleContent": {
254+
"columnMatch": "ActorUsername",
255+
"formatter": 1
256+
},
257+
"leftContent": {
258+
"columnMatch": "EventsGenerated",
259+
"formatter": 12,
260+
"formatOptions": {
261+
"palette": "auto"
262+
},
263+
"numberFormat": {
264+
"unit": 17,
265+
"options": {
266+
"maximumSignificantDigits": 3,
267+
"maximumFractionDigits": 2
268+
}
269+
}
270+
},
271+
"showBorder": false
272+
}
273+
},
274+
"name": "Most Active Users"
275+
},
276+
{
277+
"type": 3,
278+
"content": {
279+
"version": "KqlItem/1.0",
280+
"query": "Auth0Logs_CL\n| summarize Count = count() by SrcIpAddr\n| top 10 by Count desc\n",
281+
"size": 0,
282+
"title": "Frequent Source IP Addresses",
283+
"timeContextFromParameter": "TimeGenerated",
284+
"showRefreshButton": true,
285+
"showExportToExcel": true,
286+
"queryType": 0,
287+
"resourceType": "microsoft.operationalinsights/workspaces",
288+
"visualization": "categoricalbar"
289+
},
290+
"name": "Frequent Source IP Addresses"
291+
},
292+
{
293+
"type": 3,
294+
"content": {
295+
"version": "KqlItem/1.0",
296+
"query": "Auth0Logs_CL\n| summarize EventCount = count() by Scope\n| top 10 by EventCount desc\n",
297+
"size": 0,
298+
"title": "Most Accessed API Scopes",
299+
"timeContextFromParameter": "TimeGenerated",
300+
"showRefreshButton": true,
301+
"showExportToExcel": true,
302+
"queryType": 0,
303+
"resourceType": "microsoft.operationalinsights/workspaces",
304+
"visualization": "categoricalbar"
305+
},
306+
"name": "Most Accessed API Scopes"
307+
},
308+
{
309+
"type": 3,
310+
"content": {
311+
"version": "KqlItem/1.0",
312+
"query": "Auth0Logs_CL\n| summarize Count = count() by HttpUserAgent\n| order by Count desc\n| top 10 by Count\n",
313+
"size": 0,
314+
"title": "User Agent Trends",
315+
"timeContextFromParameter": "TimeGenerated",
316+
"showRefreshButton": true,
317+
"showExportToExcel": true,
318+
"queryType": 0,
319+
"resourceType": "microsoft.operationalinsights/workspaces",
320+
"visualization": "barchart",
321+
"tileSettings": {
322+
"showBorder": false,
323+
"titleContent": {
324+
"columnMatch": "HttpUserAgent",
325+
"formatter": 1
326+
},
327+
"leftContent": {
328+
"columnMatch": "Count",
329+
"formatter": 12,
330+
"formatOptions": {
331+
"palette": "auto"
332+
},
333+
"numberFormat": {
334+
"unit": 17,
335+
"options": {
336+
"maximumSignificantDigits": 3,
337+
"maximumFractionDigits": 2
338+
}
339+
}
340+
}
341+
},
342+
"graphSettings": {
343+
"type": 0,
344+
"topContent": {
345+
"columnMatch": "HttpUserAgent",
346+
"formatter": 1
347+
},
348+
"centerContent": {
349+
"columnMatch": "Count",
350+
"formatter": 1,
351+
"numberFormat": {
352+
"unit": 17,
353+
"options": {
354+
"maximumSignificantDigits": 3,
355+
"maximumFractionDigits": 2
356+
}
357+
}
358+
}
359+
}
360+
},
361+
"name": "User Agent Trends"
362+
},
363+
{
364+
"type": 3,
365+
"content": {
366+
"version": "KqlItem/1.0",
367+
"query": "Auth0Logs_CL\n| where EventType in (\"seccft\", \"logout\")\n| summarize SuspiciousEvents = count() by bin(TimeGenerated, 15m), EventType\n| order by TimeGenerated asc\n",
368+
"size": 0,
369+
"title": "Security Critical Events (seccft, logout)",
370+
"timeContextFromParameter": "TimeGenerated",
371+
"showRefreshButton": true,
372+
"showExportToExcel": true,
373+
"queryType": 0,
374+
"resourceType": "microsoft.operationalinsights/workspaces",
375+
"visualization": "areachart"
376+
},
377+
"name": "Security Critical Events (seccft, logout)"
378+
},
379+
{
380+
"type": 3,
381+
"content": {
382+
"version": "KqlItem/1.0",
383+
"query": "Auth0Logs_CL\n| summarize TotalEvents = count() by bin(TimeGenerated, 10m)\n| order by TimeGenerated asc\n",
384+
"size": 0,
385+
"title": "Events Over Time",
386+
"timeContextFromParameter": "TimeGenerated",
387+
"showRefreshButton": true,
388+
"showExportToExcel": true,
389+
"queryType": 0,
390+
"resourceType": "microsoft.operationalinsights/workspaces",
391+
"visualization": "timechart"
392+
},
393+
"name": "Events Over Time"
394+
}
395+
],
396+
"fallbackResourceIds": [],
397+
"fromTemplateId": "sentinel-Auth0Workbook",
398+
"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
399+
}

‎Workbooks/Images/Preview/Auth0Black.png‎

60.7 KB
Loading

‎Workbooks/Images/Preview/Auth0White.png‎

60.8 KB
Loading

0 commit comments

Comments
 (0)