| { | |
| "version": "Notebook/1.0", | |
| "items": [ | |
| { | |
| "type": 1, | |
| "content": { | |
| "json": "## Sign-ins using legacy authentication\r\nThis workbooks highlights which legacy authentication protocols are used throughout your tenant. Legacy authentication (or basic authentication) protocols do not support multi-factor authentication. Microsoft highly recommends blocking legacy authentication and will be deprecating the use of legacy protocols for Exchange Online." | |
| }, | |
| "customWidth": "70", | |
| "name": "text - 0" |
| // If this is too noisy, create and use the watchlist below, then uncomment the first line and last line of this query | |
| // let watchlist = (_GetWatchlist('NoisyIpApps') | project AppName); | |
| let lookback = 30d; | |
| let detectionTime = 1d; | |
| let ipNew = | |
| imAuthentication | |
| | where EventProduct == 'AAD Service Principal' | |
| | where TimeGenerated > ago(detectionTime) | |
| | summarize by ServicePrincipalName, SrcDvcIpAddr; | |
| let ipHistory = |
| // This query builds a table of historically seen file extensions and then compares it to extensions seen in the last day, listing new ones. | |
| let FileExtensionHistory = ( | |
| DeviceFileEvents | |
| | where TimeGenerated between (ago(14d)..ago(1d)) and FileName != '' // get two weeks of events | |
| | extend FileExtension = extract("\\.([0-9A-Za-z]+)(?:[\\?#]|$)", 1, FileName) // extract the file extension | |
| | where FileExtension != '' // get rid of the empty extensions | |
| | summarize by FileExtension); // project only what we need, a big list of file extensions | |
| DeviceFileEvents | |
| | where TimeGenerated between (ago(1d)..now()) and FileName != '' // get data from the last day | |
| | extend FileExtension = extract("\\.([0-9A-Za-z]+)(?:[\\?#]|$)", 1, FileName) // extract the file extension |
| // This query gets the specified historic (line 4; can be removed for all file event types) file creation events by each Host and bins them by a time period (line 6), computes the average and standard deviation, and then adds them to get a dynamic threshold for each Host. It then joins the data in the recent time period (line 10) and drops Hosts under their threshold. | |
| let mod_threshold = ( | |
| imFileEvent | |
| | where TimeGenerated between (ago(14d)..ago(1d)) // get two weeks of events | |
| | where EventType == "FileCreated" // get file creations; can remove this line for all file events or alter for deleted, modified, etc. | |
| | summarize cnt=count() by DvcHostname, bin(TimeGenerated, 1h) //count the events for each host by hour specified, default 1 | |
| | summarize avg(cnt), stdev(cnt) by DvcHostname // compute the average and standard deviation for each Host | |
| | project average = avg_cnt, threshold = avg_cnt + stdev_cnt, DvcHostname); // project only what we need | |
| imFileEvent | |
| | where TimeGenerated between (ago(1h)..now()) // get da |
| // This query builds a table of historically seen file extensions and then compares it to extensions seen in the last day, listing new ones. | |
| let FileExtensionHistory = ( | |
| imFileEvent | |
| | where TimeGenerated between (ago(14d)..ago(1d)) // get two weeks of events | |
| | where FilePath !startswith "C:\\Windows\\Temp\\" and FilePath !startswith "/tmp/" //drop temp directories with random file names | |
| | extend FileExtension = extract("\\.([0-9A-Za-z]+)(?:[\\?#]|$)", 1, FilePath) // extract the file extension | |
| | where FileExtension != '' // get rid of the empty extensions | |
| | summarize by FileExtension); // project only what we need, a big list of file extensions | |
| imFileEvent | |
| | where TimeGenerated between (ago(1d)..now()) // get data from the last day |
| let request_threshold = toscalar( | |
| AzureDiagnostics | |
| | where Category contains "FrontDoorAccessLog" | |
| | where TimeGenerated >= startofday(ago(90d)) and TimeGenerated < startofday(now()) | |
| | summarize cnt=count() by clientIp_s, bin(TimeGenerated, 1d) | |
| | summarize avg(cnt), stdev(cnt) | |
| | project threshold = avg_cnt+stdev_cnt); | |
| AzureDiagnostics | |
| | where Category == "FrontdoorAccessLog" | |
| | summarize count() by userAgent_s,clientIp_s |
With the execption of infrastructure setup for Syslog/CEF or WEF/WEC, you can connect all this with the following roles and permissions:
I hereby claim:
To claim this, I am signing this object: