+ If you’ve never used an Automation Account before, you may need to follow [these instructions] (https://learn.microsoft.com/en-us/azure/automation/quickstarts/create-azure-automation-account-portal) to enable automation in Azure.
-
Once, you have that enabled find the Automation Accounts in Azure and select +Create to create a new one.
-
-
-
-
-
-After hitting next, you’ll fill out the Basics information including the Subscription, Resource group and Region.
-
You’ll also need to give the Automation Account a name.
-
-
-
-
-
-Select Next and confirm that the System assigned check box is checked.
-
If you want to change the Networking settings (I change mine to Private access) or add Tags, do so. And then press Review + Create.
-
-
-
-
-
Now that the account is created, we need to give it permissions to make the SCU change.
-
In another browser tab, locate your Security Copilot Resource and select Access Control (IAM).
-
Select the +Add button and choose Add role assignment.
-
-
-
-
-
Select the Privileged administrator roles tab and select Contributor.
-
-
-
-
-
You may be thinking - “Whoa! I’m giving Contributor rights to this account.”
-
But managed identities are the preferred method for runbooks because they allow your runbook to easily access other Microsoft Entra protected resources.
-
The identity is managed by the Azure platform and doesn't require you to provision or rotate any secrets. If you need more information, find it here.
-
-
Now let’s pop back to our other tab and create the Runbook.
-
Find Runbooks in the Process Automation section. Select +Create a runbook.
-
-
-
-
-
Give it a name, select PowerShell as the Runbook type and 7.2 as the Runtime version. Then press Review + Create.
-
-
-
-
-You should now be at the Edit PowerShell Runbook page. Paste this code in the window. This code will change the number of SCUs from your current setting to one SCU.
-```
-Connect-AzAccount -Identity
-Set-AzContext -Subscription "your subscription"
-$Resource = Get-AzResource -ResourceGroupName YourResourceGroup -ResourceName TheNameofYourCoilotResource -ResourceType microsoft.securitycopilot/capacities
-$Resource.Properties.numberOfUnits = 1
-$Resource | Set-AzResource -Force
-```
-You can test it if you like in the Test pane. This will show you if there are any errors. Save the runbook.
-
-Now, we’re going to set it so that this runbook kicks off every night at 10 p.m. Make your way back to the Azure Automation page and select Schedules in the Shared Resources section. Select +Add a schedule. Give the schedule a Name and select the date you want it to start. Select Recurring in the Recurrence section. And set Recur every to 1 Day. Set the expiration if you want to. Now select Create.
-
-
-
-
-Now you’re all finished! You can duplicate these steps to create another Automation that increases the SCUs at 7 am or whatever time your team starts their day.
-
-And remember, if you are working an incident at 2 a.m. and need more SCUs, you can manually change this in the Azure portal at any time.
diff --git a/Monitoring/SCU Capacity Optimizer/customrole/azuredeploy.json b/Monitoring/SCU Capacity Optimizer/customrole/azuredeploy.json
deleted file mode 100644
index e577b313..00000000
--- a/Monitoring/SCU Capacity Optimizer/customrole/azuredeploy.json
+++ /dev/null
@@ -1,43 +0,0 @@
-{
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/subscriptiondeploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "parameters": {
- "SecurityCopilotCreatorRoleName": {
- "defaultValue": "Security Copilot Compute Creator",
- "type": "string"
- }
- },
- "variables": {
- "rbacGuid": "[guid(deployment().name)]"
- },
- "resources": [
- {
- "type": "Microsoft.Authorization/roleDefinitions",
- "apiVersion": "2017-05-01",
- "name": "[variables('rbacGuid')]",
- "properties": {
- "roleName": "[parameters('SecurityCopilotCreatorRoleName')]",
- "IsCustom": true,
- "Description": "This role is designed to allow the creation of Security Copilot Compute Capacities, including the scaling SCU count.",
- "permissions": [
- {
- "Actions": [
- "Microsoft.SecurityCopilot/capacities/read",
- "Microsoft.SecurityCopilot/capacities/write"
- ],
- "NotActions": []
- }
- ],
- "AssignableScopes": [
- "[subscription().id]"
- ]
- }
- }
- ],
- "outputs": {
- "assignableScope": {
- "type": "string",
- "value": "[subscription().id]"
- }
- }
-}
\ No newline at end of file
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Dark.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Dark.png
deleted file mode 100644
index c42b4468..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Dark.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Light.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Light.png
deleted file mode 100644
index 51b089c2..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Edit_Light.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Dark.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Dark.png
deleted file mode 100644
index cc54ef01..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Dark.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Light.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Light.png
deleted file mode 100644
index fd80ff71..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_Scaler_Logicapp_Light.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Dark.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Dark.png
deleted file mode 100644
index a5eb4b7e..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Dark.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Light.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Light.png
deleted file mode 100644
index a0bbe643..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_View_Light.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_solution-architecture.png b/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_solution-architecture.png
deleted file mode 100644
index 71ee74c5..00000000
Binary files a/Monitoring/SCU Capacity Optimizer/images/SCU_Capacity_Optimizer_solution-architecture.png and /dev/null differ
diff --git a/Monitoring/SCU Capacity Optimizer/readme.md b/Monitoring/SCU Capacity Optimizer/readme.md
deleted file mode 100644
index 3df07fe9..00000000
--- a/Monitoring/SCU Capacity Optimizer/readme.md
+++ /dev/null
@@ -1,116 +0,0 @@
-# SCU Capacity Optimizer
-Author: Lachlan Watson
-
-This solution will allow you to view and control the Security Copilot Compute Capacity SCUs based on a schedule.
-The solution is created using 2 core components:
-- Sentinel Workbook - Security Copilot Optimizer
-- Playbook (Logic App) - Security Copilot Scaler
-
-In the event of a SOC operating in a more limited capacity than 24x7 such as 8x5 this can mean significant cost savings by allowing the playbook to scale the compute capacity according to the schedule that has been applied while still taking advantage of the robust capabilities from Security Copilot.
-
-
-
-The Security Copilot Optimizer Sentinel solution offers 3 core features:
-
-1. View - Security teams can view existing scheduling (or lack there of) on a Compute Capacity, and displays predicted costs of the solution
-
-2. Modify - Security architects can add/modify existing schedules, view cost calculations based on the new schedule, and compare it with the existing config. This is achieved by applying a Resource Tag called: **SecurityCopilotConfig**.
-
-3. Apply - Finally, the Playbook/LogicApp runs hourly (5 minutes after the hour, to avoid conflict with other automations), to find resources with the SecurityCopilotConfig tag applied, then for each compute capacity evaluates high usage schedule configuration to determine the correct SCU count, then applies if any changes need to be made.
-
-The SecurityCopilotConfig tag holds the information required by the Playbook to apply separate configs across multiple compute capacities.
-
-Here is the structure of the Resource Tag:
-
-```json
- {
- "SCULimits": {
- "Min": 1, "Max": 3
- },
- "Schedule": {
- "ActiveDays": [
- 1, 2, 3, 4
- ],
- "ActiveStartHour": 8,
- "ActiveEndHour": 18,
- "TimeOffset": -6
- }
- }
-```
-Property definitions:
-- SCULimits
- - Min: SCU count applied for Low Usage days/times
- - Max: SCU count applied for High Usage days/times
-- Schedule
- - ActiveDays: integer representations of days of the week:
- - 0 = Sunday
- - 1 = Monday
- - 2 = Tuesday
- - 3 = Wednesday
- - 4 = Thursday
- - 5 = Friday
- - 6 = Saturday
- - ActiveStartHour: for high usage days, time when Maximum SCU count should be applied
- - ActiveEndHour: for high usage days, time when Minimum SCU count should be applied
- - TimeOffset: Hour offset from UTC. This is leveraged to ensure CfS is operating in the desired local time, and is paired with the workbook to validate offset to local comparison.
-
-## Prerequisites
-
-### Azure Resource Requirements
-- Security Copilot Compute Capacity - So we have something to which we can view/apply a schedule
-- Log Analytics Workspace (ideally Sentinel enabled) for operation of the Workbook
-
-### Azure RBAC Requirements
-Least-privilege resource deployment requires:
-- Workbook - Monitoring Contributor
-- Playbook - Logic App Contributor
-
-Post-config requirements:
-- Subscription Owner is required to create and apply a least-privilege custom role for the Playbook. You may choose to assign the Contributor role if you do not want to use a custom role.
-
-Usage requirements:
-- Contributor access of some kind is required to the Security Copilot Compute Capacity for any users who will be modifying the schedule since it works by applying Resource Tags to the Compute Capacity.
-
-## Deployment
-**Deploy Solution**
-[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FSecurity-Copilot%2Fmain%2FMonitoring%2FSCU%20Capacity%20Optimizer%2Fsolution%2Fazuredeploy.json)
-
-Note: During deployment, the selected Playbook Resource Group must be different than the Sentinel Resource Group.
-
-
-## Post-deployment
-1. (Optional) Deploy the Security Copilot Capacity Creator role to each subscription where Security Copilot Compute Capacities are present for a least-privilege approach
-[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FSecurity-Copilot%2Fmain%2FMonitoring%2FSCU%20Capacity%20Optimizer%2Fcustomrole%2Fazuredeploy.json)
-
-2. Assign the Security Copilot Capacity Creator custom role, or Contributor built-in role to the Playbook's managed identity - https://docs.microsoft.com/azure/logic-apps/create-managed-service-identity?tabs=consumption#assign-managed-identity-role-based-access-in-the-azure-portal
-
-3. Open the playbook in the Logic App Designer and ensure connections are displaying correctly
-
-## Usage
-**Basic usage steps:**
-
-1. The Security Copilot SCU Optimizer workbook should now be present in your Sentinel workspace. If you don't have Sentinel access, or don't have Sentinel enabled, then you can find the Azure Workbook resource in your Sentinel resource group.
-
-2. Select a Security Copilot Compute Capacity. You should see if there is or is not a schedule applied to that Compute Capacity.
-
-3. Select the Edit tab, and select the desired schedule to review the cost changes based on your team's standard work hours.
-
-4. When ready, select the **Apply Configuration** button to deploy the Resource Tags.
-
-5. When the next hour rolls around, the Playbook/Logic app will trigger, evaluate the Resource Tag, and apply the appropriate SCU limit to the Compute Capacity.
- - If you'd like the changes to apply immediately you can manually trigger the Playbook.
-
-[Learn more about Security Copilot](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot)
-[Learn more about Playbooks (Logic Apps)](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-overview)
-[Learn more about Workbooks](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview)
-
-## Screenshots
-**Workbook - View No Schedule**
-
-
-**Workbook - Apply/Modify Schedule**
-
-
-**Playbook**
-
-
\ No newline at end of file
diff --git a/Monitoring/SCU Capacity Optimizer/solution/azuredeploy.json b/Monitoring/SCU Capacity Optimizer/solution/azuredeploy.json
deleted file mode 100644
index e2e857de..00000000
--- a/Monitoring/SCU Capacity Optimizer/solution/azuredeploy.json
+++ /dev/null
@@ -1,635 +0,0 @@
-{
- "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "metadata": {
- "title": "",
- "description": "",
- "prerequisites": "",
- "postDeployment": [],
- "prerequisitesDeployTemplateFile": "",
- "lastUpdateTime": "",
- "entities": [],
- "tags": [],
- "support": {
- "tier": "community",
- "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator"
- },
- "author": {
- "name": ""
- }
- },
- "parameters": {
- "resourceLocation": {
- "type": "string",
- "allowedValues": [
- "australiaeast",
- "australiasoutheast",
- "brazilsouth",
- "brazilsoutheast",
- "canadacentral",
- "canadaeast",
- "centralindia",
- "centralus",
- "eastasia",
- "eastus",
- "eastus2",
- "francecentral",
- "francesouth",
- "germanynorth",
- "germanywestcentral",
- "israelcentral",
- "italynorth",
- "japaneast",
- "japanwest",
- "jioindiawest",
- "koreacentral",
- "koreasouth",
- "northcentralus",
- "northeurope",
- "norwayeast",
- "norwaywest",
- "polandcentral",
- "qatarcentral",
- "southafricanorth",
- "southafricawest",
- "southcentralus",
- "southeastasia",
- "southindia",
- "swedencentral",
- "switzerlandnorth",
- "switzerlandwest",
- "uaecentral",
- "uaenorth",
- "uksouth",
- "ukwest",
- "westcentralus",
- "westeurope",
- "westindia",
- "westus",
- "westus2",
- "westus3"
- ],
- "defaultValue": "eastus",
- "metadata": {
- "description": "The location of the resources to be deployed."
- }
- },
- "playbookResourceGroup": {
- "defaultValue": "",
- "type": "string",
- "metadata": {
- "description": "The name of the Resource Group to store Security Copilot playbooks. This must be different than the Sentinel Resource Group."
- }
- },
- "playbookName": {
- "defaultValue": "lga-securitycopilot-scu-scaler",
- "type": "string",
- "metadata": {
- "description": "The name of the playbook associated with the workbook that applies the schedule hourly to the Security Copilot Compute Capacities."
- }
- },
- "sentinelResourceGroup": {
- "type": "string",
- "defaultValue": "",
- "metadata": {
- "description": "Sentinel Workbooks are required be installed in the Sentinel Resource Group."
- }
- },
- "sentinelWorkspaceName": {
- "type": "string",
- "defaultValue": "",
- "metadata": {
- "description": "The name of Sentinel instance to which the workbook will be associated"
- }
- },
- "sentinelWorkbookDisplayName": {
- "type": "string",
- "defaultValue": "Security Copilot SCU Capacity Optimizer",
- "metadata": {
- "description": "The friendly name for the workbook that is used in the Gallery or Saved List. This name must be unique within a resource group."
- }
- },
- "sentinelWorkbookId": {
- "type": "string",
- "defaultValue": "[newGuid()]",
- "metadata": {
- "description": "The unique guid for this workbook instance. If new, leave as default"
- }
- }
- },
- "variables": {
- "ArmConnectionName": "[concat('mgid-', parameters('PlaybookName'))]"
- },
- "resources": [
- {
- "type": "Microsoft.Resources/deployments",
- "apiVersion": "2021-04-01",
- "name": "nestedTemplate",
- "resourceGroup": "[parameters('playbookResourceGroup')]",
- "subscriptionId": "[subscription().subscriptionId]",
- "properties": {
- "mode": "Incremental",
- "template": {
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "parameters": {},
- "variables": {},
- "resources": [
- {
- "type": "Microsoft.Web/connections",
- "apiVersion": "2016-06-01",
- "name": "[variables('ArmConnectionName')]",
- "location": "[parameters('resourceLocation')]",
- "kind": "V1",
- "properties": {
- "displayName": "[variables('ArmConnectionName')]",
- "customParameterValues": {},
- "parameterValueType": "Alternative",
- "api": {
- "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', parameters('resourceLocation'), '/managedApis/arm')]"
- }
- }
- },
- {
- "name": "[parameters('PlaybookName')]",
- "type": "Microsoft.Logic/workflows",
- "location": "[parameters('resourceLocation')]",
- "tags": {},
- "identity": {
- "type": "SystemAssigned"
- },
- "apiVersion": "2017-07-01",
- "dependsOn": [
- "[resourceId(subscription().subscriptionId,parameters('playbookResourceGroup'),'Microsoft.Web/connections', variables('ArmConnectionName'))]"
- ],
- "properties": {
- "provisioningState": "Succeeded",
- "state": "Enabled",
- "definition": {
- "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
- "contentVersion": "1.0.0.0",
- "parameters": {
- "$connections": {
- "defaultValue": {},
- "type": "Object"
- }
- },
- "triggers": {
- "Recurrence_-_Every_Hour": {
- "recurrence": {
- "interval": 1,
- "frequency": "Hour",
- "timeZone": "Eastern Standard Time",
- "startTime": "2024-05-23T17:05:00Z"
- },
- "evaluatedRecurrence": {
- "interval": 1,
- "frequency": "Hour",
- "timeZone": "Eastern Standard Time",
- "startTime": "2024-05-23T17:05:00Z"
- },
- "type": "Recurrence"
- }
- },
- "actions": {
- "List_subscriptions": {
- "runAfter": {},
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "get",
- "path": "/subscriptions",
- "queries": {
- "x-ms-api-version": "2016-06-01"
- }
- }
- },
- "For_Each_-_Subscription": {
- "foreach": "@body('List_subscriptions')?['value']",
- "actions": {
- "List_resources_by_subscription": {
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "get",
- "path": "/subscriptions/@{encodeURIComponent(items('For_Each_-_Subscription')?['subscriptionId'])}/resources",
- "queries": {
- "x-ms-api-version": "2016-06-01",
- "$filter": "tagName eq 'SecurityCopilotConfig'"
- }
- }
- },
- "For_Each_-_Resource": {
- "foreach": "@body('List_resources_by_subscription')?['value']",
- "actions": {
- "Parse_SecurityCopilot_Tag_JSON": {
- "runAfter": {
- "Read_a_resource": [
- "Succeeded"
- ]
- },
- "type": "ParseJson",
- "inputs": {
- "content": "@replace(item()?['tags']['SecurityCopilotConfig'],'\\', '')",
- "schema": {
- "type": "object",
- "properties": {
- "SCULimits": {
- "type": "object",
- "properties": {
- "Min": {
- "type": "integer"
- },
- "Max": {
- "type": "integer"
- }
- }
- },
- "Schedule": {
- "type": "object",
- "properties": {
- "ActiveDays": {
- "type": "array",
- "items": {
- "type": "integer"
- }
- },
- "ActiveStartHour": {
- "type": "integer"
- },
- "ActiveEndHour": {
- "type": "integer"
- },
- "TimeOffset": {
- "type": "integer"
- }
- }
- }
- }
- }
- }
- },
- "Condition_-_Is_Active_SCU_Day": {
- "actions": {
- "Condition_-_Is_Active_Time": {
- "actions": {
- "Condition_-_Is_Current_SCU_not_equal_to_Max_SCU": {
- "actions": {
- "Create_or_update_a_resource_-_High_Usage_Day_-_High_Usage_Hours": {
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "put",
- "body": {
- "location": "@item()?['location']",
- "tags": "@body('Read_a_resource')?['tags']",
- "properties": {
- "numberOfUnits": "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Max']",
- "crossGeoCompute": "@{body('Read_a_resource')?['properties']['crossGeoCompute']}",
- "geo": "@{body('Read_a_resource')?['properties']['geo']}"
- }
- },
- "path": "/subscriptions/@{encodeURIComponent(split(item()?['id'], '/')[2])}/resourcegroups/@{encodeURIComponent(split(item()?['id'], '/')[4])}/providers/@{encodeURIComponent('Microsoft.SecurityCopilot')}/@{encodeURIComponent('capacities/',split(item()?['id'], '/')[8])}",
- "queries": {
- "x-ms-api-version": "2023-12-01-preview"
- }
- }
- }
- },
- "else": {
- "actions": {}
- },
- "expression": {
- "and": [
- {
- "not": {
- "equals": [
- "@body('Read_a_resource')?['properties']['numberOfUnits']",
- "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Max']"
- ]
- }
- }
- ]
- },
- "type": "If"
- }
- },
- "else": {
- "actions": {
- "Condition_-_Is_Current_SCU_not_equal_to_Min_SCU": {
- "actions": {
- "Create_or_update_a_resource_-_Active_Day_-_Inactive_Hours": {
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "put",
- "body": {
- "location": "@item()?['location']",
- "tags": "@body('Read_a_resource')?['tags']",
- "properties": {
- "numberOfUnits": "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Min']",
- "crossGeoCompute": "@{body('Read_a_resource')?['properties']['crossGeoCompute']}",
- "geo": "@{body('Read_a_resource')?['properties']['geo']}"
- }
- },
- "path": "/subscriptions/@{encodeURIComponent(split(item()?['id'], '/')[2])}/resourcegroups/@{encodeURIComponent(split(item()?['id'], '/')[4])}/providers/@{encodeURIComponent('Microsoft.SecurityCopilot')}/@{encodeURIComponent('capacities/',split(item()?['id'], '/')[8])}",
- "queries": {
- "x-ms-api-version": "2023-12-01-preview"
- }
- }
- }
- },
- "else": {
- "actions": {}
- },
- "expression": {
- "and": [
- {
- "not": {
- "equals": [
- "@body('Read_a_resource')?['properties']['numberOfUnits']",
- "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Min']"
- ]
- }
- }
- ]
- },
- "type": "If"
- }
- }
- },
- "expression": {
- "and": [
- {
- "greaterOrEquals": [
- "@int(addHours(utcNow(), body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['TimeOffset'],'HH'))",
- "@body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['ActiveStartHour']"
- ]
- },
- {
- "less": [
- "@int(addHours(utcNow(), body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['TimeOffset'],'HH'))",
- "@body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['ActiveEndHour']"
- ]
- }
- ]
- },
- "type": "If"
- }
- },
- "runAfter": {
- "Set_variable_-_varActiveDays": [
- "Succeeded"
- ]
- },
- "else": {
- "actions": {
- "Condition_-_Is_Current_SCU_not_equal_to_Min_SCU_2": {
- "actions": {
- "Create_or_update_a_resource_-_Inactive_Day": {
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "put",
- "body": {
- "location": "@item()?['location']",
- "tags": "@body('Read_a_resource')?['tags']",
- "properties": {
- "numberOfUnits": "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Min']",
- "crossGeoCompute": "@{body('Read_a_resource')?['properties']['crossGeoCompute']}",
- "geo": "@{body('Read_a_resource')?['properties']['geo']}"
- }
- },
- "path": "/subscriptions/@{encodeURIComponent(split(item()?['id'], '/')[2])}/resourcegroups/@{encodeURIComponent(split(item()?['id'], '/')[4])}/providers/@{encodeURIComponent('Microsoft.SecurityCopilot')}/@{encodeURIComponent('capacities/',split(item()?['id'], '/')[8])}",
- "queries": {
- "x-ms-api-version": "2023-12-01-preview"
- }
- }
- }
- },
- "else": {
- "actions": {}
- },
- "expression": {
- "and": [
- {
- "not": {
- "equals": [
- "@body('Read_a_resource')?['properties']['numberOfUnits']",
- "@body('Parse_SecurityCopilot_Tag_JSON')?['SCULimits']?['Min']"
- ]
- }
- }
- ]
- },
- "type": "If"
- }
- }
- },
- "expression": {
- "and": [
- {
- "contains": [
- "@variables('varActiveDays')",
- "@variables('varDayOfWeek')"
- ]
- }
- ]
- },
- "type": "If"
- },
- "Read_a_resource": {
- "type": "ApiConnection",
- "inputs": {
- "host": {
- "connection": {
- "name": "@parameters('$connections')['arm']['connectionId']"
- }
- },
- "method": "get",
- "path": "/subscriptions/@{encodeURIComponent(split(item()?['id'], '/')[2])}/resourcegroups/@{encodeURIComponent(split(item()?['id'], '/')[4])}/providers/@{encodeURIComponent('Microsoft.SecurityCopilot')}/@{encodeURIComponent(concat('capacities/', split(item()?['id'], '/')[8]))}",
- "queries": {
- "x-ms-api-version": "2023-12-01-preview"
- }
- }
- },
- "Set_variable_-_varActiveDays": {
- "runAfter": {
- "Set_variable_-_varDayOfWeek": [
- "Succeeded"
- ]
- },
- "type": "SetVariable",
- "inputs": {
- "name": "varActiveDays",
- "value": "@body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['ActiveDays']"
- }
- },
- "Set_variable_-_varDayOfWeek": {
- "runAfter": {
- "Parse_SecurityCopilot_Tag_JSON": [
- "Succeeded"
- ]
- },
- "type": "SetVariable",
- "inputs": {
- "name": "varDayOfWeek",
- "value": "@int(dayOfWeek(addHours(utcNow(), body('Parse_SecurityCopilot_Tag_JSON')?['Schedule']?['TimeOffset'])))"
- }
- }
- },
- "runAfter": {
- "List_resources_by_subscription": [
- "Succeeded"
- ]
- },
- "type": "Foreach",
- "runtimeConfiguration": {
- "concurrency": {
- "repetitions": 1
- }
- }
- }
- },
- "runAfter": {
- "Initialize_varCleanTags": [
- "Succeeded"
- ]
- },
- "type": "Foreach",
- "runtimeConfiguration": {
- "concurrency": {
- "repetitions": 1
- }
- }
- },
- "Initialize_variable_-_varDayOfWeek": {
- "runAfter": {
- "List_subscriptions": [
- "Succeeded"
- ]
- },
- "type": "InitializeVariable",
- "inputs": {
- "variables": [
- {
- "name": "varDayOfWeek",
- "type": "integer"
- }
- ]
- }
- },
- "Initialize_varCleanTags": {
- "runAfter": {
- "Initialize_variable_-_varActiveDays": [
- "Succeeded"
- ]
- },
- "type": "InitializeVariable",
- "inputs": {
- "variables": [
- {
- "name": "varCleanTags",
- "type": "object"
- }
- ]
- }
- },
- "Initialize_variable_-_varActiveDays": {
- "runAfter": {
- "Initialize_variable_-_varDayOfWeek": [
- "Succeeded"
- ]
- },
- "type": "InitializeVariable",
- "inputs": {
- "variables": [
- {
- "name": "varActiveDays",
- "type": "array"
- }
- ]
- }
- }
- },
- "outputs": {}
- },
- "parameters": {
- "$connections": {
- "value": {
- "arm": {
- "connectionId": "[resourceId(subscription().subscriptionId,parameters('playbookResourceGroup'),'Microsoft.Web/connections', variables('ArmConnectionName'))]",
- "connectionName": "[variables('ArmConnectionName')]",
- "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', parameters('resourceLocation'), '/managedApis/arm')]",
- "connectionProperties": {
- "authentication": {
- "type": "ManagedServiceIdentity"
- }
- }
- }
- }
- }
- }
- }
- }
- ]
- },
- "parameters": {}
- }
- },
- {
- "type": "Microsoft.Resources/deployments",
- "apiVersion": "2021-04-01",
- "name": "nestedTemplate",
- "resourceGroup": "[parameters('sentinelResourceGroup')]",
- "subscriptionId": "[subscription().subscriptionId]",
- "properties": {
- "mode": "Incremental",
- "template": {
- "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
- "contentVersion": "1.0.0.0",
- "parameters": {},
- "variables": {},
- "resources": [
- {
- "name": "[parameters('sentinelWorkbookId')]",
- "type": "microsoft.insights/workbooks",
- "location": "[parameters('resourceLocation')]",
- "apiVersion": "2022-04-01",
- "dependsOn": [],
- "kind": "shared",
- "properties": {
- "displayName": "[parameters('sentinelWorkbookDisplayName')]",
- "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f368d9e2-9d09-4574-a430-f502386bbdd0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"resourcecontainers\\r\\n| where type == \\\"microsoft.resources/subscriptions\\\"\",\"crossComponentResources\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"value\":[\"value::all\"]},{\"id\":\"90fe1617-a8fd-46b3-aa4e-cd86cc1ab277\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogAnalyticsWorkspace\",\"label\":\"Log Analytics Workspace\",\"type\":5,\"isRequired\":true,\"query\":\"resources\\r\\n| where type == \\\"microsoft.operationalinsights/workspaces\\\"\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true},\"additionalResourceOptions\":[],\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"8d055c65-cd00-4640-af41-693e9d444a73\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SCUPrice\",\"label\":\"Price per SCU\",\"type\":1,\"description\":\"This is used to calculate the estimated costs below. It is not necessary to specify a type of currency, though estimate labels show \\\"$\\\"\",\"isRequired\":true,\"query\":\"print \\\"4\\\"\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b26debb3-5d28-4ec2-bf0c-bb3304f0aad1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"SCUDropdownLimit\",\"label\":\"SCU Dropdown Limit\",\"type\":2,\"description\":\"Modifies the limit available in the Minimum SCU and Maximum SCU dropdowns under the \\\"Add/Edit Schedule\\\" tab\",\"isRequired\":true,\"query\":\"range SCU from 20 to 100 step 10\\r\\n| project value = SCU, label = strcat(SCU, iff(SCU>1,\\\" SCUs\\\", \\\" SCU\\\")), selected = iff(SCU == toint(20), true, false)\\r\\n\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"ef17d7a7-8d54-41cd-91d6-b1ec220276a0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"📖Help\",\"type\":10,\"description\":\"This displays getting started text to help you validate your solution, and work through visualizing and applying schedules to your Security Copilot Compute Capacities.\",\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n { \\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\": \\\"Change Log\\\", \\\"label\\\": \\\"Change Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":\"Yes\"},{\"id\":\"83e8f941-0eeb-4614-b553-ae94d8dd5e1e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResourceId\",\"type\":1,\"query\":\"print ResourceId = \\\"Blank\\\"\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"3c398c1c-654f-4792-8c16-ac9232983454\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ResourceName\",\"type\":1,\"isHiddenWhenLocked\":true},{\"id\":\"1704ba63-2cf5-44b6-8762-30b24e505223\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CurrentSCU\",\"type\":1,\"isHiddenWhenLocked\":true},{\"id\":\"4238ba76-54a2-4d73-a1fb-6429780df635\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MinSCU\",\"label\":\"MinSCU Default\",\"type\":1,\"query\":\"print MinSCU = 0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"a3a2daa5-d024-4412-bfee-e37e25342d2d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MaxSCU\",\"label\":\"MaxSCU Default\",\"type\":1,\"query\":\"print MaxSCU = 0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"faa23c27-33f9-4587-801c-4e3a53565eec\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActiveDays\",\"label\":\"High Usage Days Default\",\"type\":2,\"multiSelect\":true,\"quote\":\"\",\"delimiter\":\",\",\"query\":\"let NewActiveDays = datatable(value:int, label:string, selected:boolean) [\\r\\n0, \\\"Sunday\\\", false,\\r\\n1, \\\"Monday\\\", true,\\r\\n2, \\\"Tuesday\\\", true,\\r\\n3, \\\"Wednesday\\\", true,\\r\\n4, \\\"Thursday\\\", true,\\r\\n5, \\\"Friday\\\", true,\\r\\n6, \\\"Saturday\\\",false\\r\\n];\\r\\nNewActiveDays\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"247ee385-d118-4647-9539-3aa0bf4a6a8f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActiveStartHour\",\"label\":\"High Usage Start Time Default\",\"type\":1,\"isHiddenWhenLocked\":true,\"value\":\"9\"},{\"id\":\"0d08608a-793c-4e02-a5ef-1de3d490a64d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActiveEndHour\",\"label\":\"High Usage End Time Default\",\"type\":1,\"isHiddenWhenLocked\":true,\"value\":\"17\"},{\"id\":\"f6a6332c-62f5-4469-b318-276c6207b0bd\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeOffset\",\"label\":\"Time Offset from UTC Default\",\"type\":1,\"isHiddenWhenLocked\":true,\"value\":\"0\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":1,\"content\":{\"json\":\"# Change Log:\\r\\n\\r\\n### 12/Nov/2024\\r\\n - Added Change Log\\r\\n - Added SCU Dropdown Limit parameter to allow modification of Min and Max SCU Dropdown limits\\r\\n - Adjusted Add/Modify graph to display Time Offset based on Dropdown\\r\\n \\t- Previously this was displaying Time Offset from Resource Tags, so it was unset when deploying a new Schedule\\r\\n - Added more details to Deploy Schedule UI to provide instructions for manual deployment\\r\\n - Added Help text to explain Schedule cost calculations\\r\\n - Changed label from \\\"Copilot for Security\\\" to \\\"Security Copilot\\\"\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"📖Help\",\"comparison\":\"isEqualTo\",\"value\":\"Change Log\"},\"name\":\"ChangeLog - 1\"},{\"type\":1,\"content\":{\"json\":\"# Welcome to the Security Copilot SCU Capacity Optimizer\\r\\n\\r\\nAuthor: Lachlan Watson\\r\\n\\r\\nThis solution will allow you to view and control the Security Copilot Compute Capacity SCUs based on a schedule.
\\r\\nThe solution is created using 2 core components:\\r\\n- Sentinel Workbook - Security Copilot SCU Capacity Optimizer\\r\\n- Playbook (Logic App) - Security Copilot SCU Scaler\\r\\n\\r\\nIn the event of a SOC operating in a more limited capacity than 24x7 such as 8x5 this can mean significant cost savings by allowing the playbook to scale the compute capacity according to the schedule that has been applied while still taking advantage of the robust capabilities from Security Copilot.
\\r\\n\\r\\nIf you do not already have the Playbook deployed, refer to the solution documentation for complete install instructions:\\r\\n[Solution Documentation](https://aka.ms/scuoptimizer)\\r\\n\\r\\n\\r\\n\\r\\nThe Security Copilot SCU Capacity Optimizer solution offers 3 core features:
\\r\\n\\r\\n1. View - Security teams can view existing scheduling (or lack there of) on a Compute Capacity, and displays predicted costs of the solution\\r\\n\\r\\n2. Modify - Security architects can add/modify existing schedules, view cost calculations based on the new schedule, and compare it with the existing config. This is achieved by applying a Resource Tag called: **SecurityCopilotConfig**.\\r\\n\\r\\n3. Apply - Finally, the Playbook/LogicApp runs hourly (5 minutes after the hour, to avoid conflict with other automations), to find resources with the SecurityCopilotConfig tag applied, then for each compute capacity evaluates high usage schedule configuration to determine the correct SCU count, then applies if any changes need to be made.\\r\\n\\r\\nThe SecurityCopilotConfig tag holds the information required by the Playbook to apply separate configs across multiple compute capacities.\\r\\n\\r\\n## Usage\\r\\n**Requirements:**\\r\\n- View - Reader access is required to see the Security Copilot Compute Capacity\\r\\n\\r\\n- Apply/Edit - Contributor access of some kind is required to the Security Copilot Compute Capacity for any users who will be modifying the schedule since it works by applying Resource Tags.\\r\\n\\r\\n**Steps**\\r\\n\\r\\n1. Select a Security Copilot Compute Capacity. In the View tab you will see if there is or is not a schedule applied to that Compute Capacity, and a visualization of the deployed SCU capacities over time.\\r\\n2. Select the Add/Edit Schedule tab, enter the desired schedule to review the cost changes based on your team's standard work hours.\\r\\n3. When ready, select the **Apply Configuration** button to deploy the Resource Tags.\\r\\n4. When the next hour rolls around, the Playbook/Logic app will trigger, evaluate the Resource Tag, and apply the appropriate SCU limit to the Compute Capacity.\\r\\n - This can also be manually triggered if you'd like to enforce the change immediately.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"📖Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"help - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"resources\\r\\n| where type =~ 'microsoft.securitycopilot/capacities'\\r\\n| project name, id, location, resourceGroup,subscriptionId,['Current SCU'] = tostring(properties.numberOfUnits),['Cross-Geo Compute'] = tostring(properties.crossGeoCompute), ResourceTags = todynamic(tags)\\r\\n| extend CFSConfig = tostring(ResourceTags.SecurityCopilotConfig)\\r\\n| extend HasConfig = iff (isempty(CFSConfig), False, True)\\r\\n| extend SCULimits = parse_json(CFSConfig).SCULimits, Schedule = parse_json(CFSConfig).Schedule\\r\\n| extend MinSCU = coalesce(toint(SCULimits.Min),toint(['Current SCU'])),\\r\\n MaxSCU = coalesce(toint(SCULimits.Max),toint(['Current SCU'])),\\r\\n ActiveDays = iff(isnotempty(Schedule.ActiveDays), todynamic(Schedule.ActiveDays),dynamic[{ActiveDays}])),\\r\\n ActiveStartHour = coalesce(toint(Schedule.ActiveStartHour),{ActiveStartHour}),\\r\\n ActiveEndHour = coalesce(toint(Schedule.ActiveEndHour),{ActiveEndHour}),\\r\\n TimeOffset = coalesce(toint(Schedule.TimeOffset),{TimeOffset})\\r\\n//| project ActiveEndHour\\r\\n| extend CostPerSCU = {SCUPrice}\\r\\n| extend HighUsageHours = iff(HasConfig==True, (ActiveEndHour - ActiveStartHour)* array_length(ActiveDays), 0)\\r\\n| extend LowUsageHours = ((24*7) - HighUsageHours), HighSCU = HighUsageHours * MaxSCU\\r\\n| extend LowSCU = LowUsageHours * MinSCU\\r\\n| extend TotalSCU = LowSCU + HighSCU\\r\\n| extend WeeklySCUCost = TotalSCU * CostPerSCU\\r\\n| extend MonthlySCUCost = (WeeklySCUCost/7) * 30\\r\\n| extend ConfigStatus = case(\\r\\n isempty(CFSConfig), \\\"❌ Config Missing\\\",\\r\\n \\\"✅ Config Present\\\")\\r\\n\\r\\n\\r\\n\",\"size\":4,\"title\":\"Select a Security Copilot Compute Capacity:\",\"exportedParameters\":[{\"fieldName\":\"id\",\"parameterName\":\"ResourceId\",\"parameterType\":5},{\"fieldName\":\"name\",\"parameterName\":\"ResourceName\",\"parameterType\":1},{\"fieldName\":\"Current SCU\",\"parameterName\":\"CurrentSCU\",\"parameterType\":1},{\"fieldName\":\"MinSCU\",\"parameterName\":\"MinSCU\",\"parameterType\":1},{\"fieldName\":\"MaxSCU\",\"parameterName\":\"MaxSCU\",\"parameterType\":1},{\"fieldName\":\"ActiveDays\",\"parameterName\":\"ActiveDays\",\"parameterType\":1},{\"fieldName\":\"ActiveStartHour\",\"parameterName\":\"ActiveStartHour\",\"parameterType\":1},{\"fieldName\":\"ActiveEndHour\",\"parameterName\":\"ActiveEndHour\",\"parameterType\":1},{\"fieldName\":\"CostPerSCU\",\"parameterName\":\"CostPerSCU\",\"parameterType\":1},{\"fieldName\":\"HighUsageHours\",\"parameterName\":\"HighUsageHours\",\"parameterType\":1},{\"fieldName\":\"LowUsageHours\",\"parameterName\":\"LowUsageHours\",\"parameterType\":1},{\"fieldName\":\"TotalSCU\",\"parameterName\":\"TotalSCU\",\"parameterType\":1},{\"fieldName\":\"WeeklySCUCost\",\"parameterName\":\"WeeklySCUCost\",\"parameterType\":1},{\"fieldName\":\"ConfigStatus\",\"parameterName\":\"ConfigStatus\",\"parameterType\":1},{\"fieldName\":\"TimeOffset\",\"parameterName\":\"TimeOffset\",\"parameterType\":1},{\"fieldName\":\"ResourceTags\",\"parameterName\":\"ResourceTags\",\"parameterType\":1},{\"fieldName\":\"MonthlySCUCost\",\"parameterName\":\"MonthlySCUCost\",\"parameterType\":1},{\"fieldName\":\"HasConfig\",\"parameterName\":\"HasConfig\",\"parameterType\":1}],\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\",\"crossComponentResources\":[\"{Subscription}\"],\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"name\",\"formatter\":5},{\"columnMatch\":\"ResourceTags\",\"formatter\":5},{\"columnMatch\":\"CFSConfig\",\"formatter\":5},{\"columnMatch\":\"HasConfig\",\"formatter\":5},{\"columnMatch\":\"SCULimits\",\"formatter\":5},{\"columnMatch\":\"Schedule\",\"formatter\":5},{\"columnMatch\":\"MinSCU\",\"formatter\":5},{\"columnMatch\":\"MaxSCU\",\"formatter\":5},{\"columnMatch\":\"ActiveDays\",\"formatter\":5},{\"columnMatch\":\"ActiveStartHour\",\"formatter\":5},{\"columnMatch\":\"ActiveEndHour\",\"formatter\":5},{\"columnMatch\":\"TimeOffset\",\"formatter\":5},{\"columnMatch\":\"CostPerSCU\",\"formatter\":5},{\"columnMatch\":\"HighUsageHours\",\"formatter\":5},{\"columnMatch\":\"LowUsageHours\",\"formatter\":5},{\"columnMatch\":\"HighSCU\",\"formatter\":5},{\"columnMatch\":\"LowSCU\",\"formatter\":5},{\"columnMatch\":\"TotalSCU\",\"formatter\":5},{\"columnMatch\":\"WeeklySCUCost\",\"formatter\":5},{\"columnMatch\":\"MonthlySCUCost\",\"formatter\":5}],\"rowLimit\":10},\"sortBy\":[]},\"name\":\"query - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"parameters\":[{\"id\":\"0ac976dd-c7bf-4d11-a68b-5956248370ce\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActiveDays\",\"type\":2,\"multiSelect\":true,\"quote\":\" \",\"delimiter\":\",\",\"query\":\"let ActiveDays = datatable(value:int, label:string) [\\r\\n0, \\\"Sunday\\\",\\r\\n1, \\\"Monday\\\",\\r\\n2, \\\"Tuesday\\\",\\r\\n3, \\\"Wednesday\\\",\\r\\n4, \\\"Thursday\\\",\\r\\n5, \\\"Friday\\\",\\r\\n6, \\\"Saturday\\\"\\r\\n];\\r\\nActiveDays\\r\\n| project value, label, selected = iff(value in ({ActiveDays}), true, false)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ba7a9242-cae1-49b8-8807-a35b81f10e6f\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"View Config\",\"subTarget\":\"View\",\"preText\":\"View Config\",\"style\":\"link\"},{\"id\":\"70318539-7291-4d95-85f9-30cd7ccfa38c\",\"cellValue\":\"Nav\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Add/Edit Schedule\",\"subTarget\":\"Edit\",\"preText\":\"Edit Config\",\"style\":\"link\"}]},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"ResourceId\",\"comparison\":\"isNotEqualTo\",\"value\":\"Blank\"},\"name\":\"links - 4\",\"styleSettings\":{\"maxWidth\":\"100\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"loadType\":\"always\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"parameters\":[{\"id\":\"d6cb9b36-2e00-4ab0-ac93-4f0d54ba1073\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewMinSCU\",\"label\":\"Minimum SCU\",\"type\":2,\"query\":\"range SCU from 1 to {SCUDropdownLimit} step 1\\r\\n| project value = SCU, label = strcat(SCU, iff(SCU>1,\\\" SCUs\\\", \\\" SCU\\\")), selected = iff(SCU == toint({MinSCU}), true, false)\\r\\n\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"994f321e-5368-4269-a564-04208f7b5888\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewMaxSCU\",\"label\":\"Maximum SCU\",\"type\":2,\"query\":\"range SCU from 1 to {SCUDropdownLimit} step 1\\r\\n| project value = SCU, label = strcat(SCU, iff(SCU>1,\\\" SCUs\\\", \\\" SCU\\\")), selected = iff(SCU == toint({MaxSCU}), true, false)\\r\\n\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"5d386c57-3b13-43e9-a365-4999c0a6092f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewActiveDays\",\"label\":\"High Usage Days\",\"type\":2,\"multiSelect\":true,\"quote\":\"\",\"delimiter\":\",\",\"query\":\"let NewActiveDays = datatable(value:int, label:string) [\\r\\n0, \\\"Sunday\\\",\\r\\n1, \\\"Monday\\\",\\r\\n2, \\\"Tuesday\\\",\\r\\n3, \\\"Wednesday\\\",\\r\\n4, \\\"Thursday\\\",\\r\\n5, \\\"Friday\\\",\\r\\n6, \\\"Saturday\\\"\\r\\n];\\r\\nNewActiveDays\\r\\n| project value, label, selected = iff(value in ({ActiveDays}), true, false)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4dd28d31-e64c-4233-acad-d78049f9c639\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewActiveStartHour\",\"label\":\"High Usage Start Hour\",\"type\":2,\"query\":\"let NewActiveStartHour = datatable(value:int, label:string)[\\r\\n 0,\\\"12 AM (Midnight)\\\",\\r\\n 1,\\\"1 AM\\\",\\r\\n 2,\\\"2 AM\\\" ,\\r\\n 3,\\\"3 AM\\\" ,\\r\\n 4,\\\"4 AM\\\" ,\\r\\n 5,\\\"5 AM\\\" ,\\r\\n 6,\\\"6 AM\\\" ,\\r\\n 7,\\\"7 AM\\\" ,\\r\\n 8,\\\"8 AM\\\" ,\\r\\n 9,\\\"9 AM\\\" ,\\r\\n 10,\\\"10 AM\\\" ,\\r\\n 11,\\\"11 AM\\\" ,\\r\\n 12,\\\"12 PM (Noon)\\\" ,\\r\\n 13,\\\"1 PM\\\" ,\\r\\n 14,\\\"2 PM\\\" ,\\r\\n 15,\\\"3 PM\\\" ,\\r\\n 16,\\\"4 PM\\\" ,\\r\\n 17,\\\"5 PM\\\" ,\\r\\n 18,\\\"6 PM\\\" ,\\r\\n 19,\\\"7 PM\\\" ,\\r\\n 20,\\\"8 PM\\\" ,\\r\\n 21,\\\"9 PM\\\" ,\\r\\n 22,\\\"10 PM\\\" ,\\r\\n 23,\\\"11 PM\\\" \\r\\n];\\r\\nNewActiveStartHour\\r\\n|project value, label, selected = iff(value == {ActiveStartHour}, true, false)\\r\\n\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"320bfeaa-ee23-4fbf-9e9d-067e5ed915f8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewActiveEndHour\",\"label\":\"High Usage End Hour\",\"type\":2,\"query\":\"let NewActiveEndHour = datatable(value:int, label:string)[\\r\\n 0,\\\"12 AM (Midnight)\\\",\\r\\n 1,\\\"1 AM\\\",\\r\\n 2,\\\"2 AM\\\" ,\\r\\n 3,\\\"3 AM\\\" ,\\r\\n 4,\\\"4 AM\\\" ,\\r\\n 5,\\\"5 AM\\\" ,\\r\\n 6,\\\"6 AM\\\" ,\\r\\n 7,\\\"7 AM\\\" ,\\r\\n 8,\\\"8 AM\\\" ,\\r\\n 9,\\\"9 AM\\\" ,\\r\\n 10,\\\"10 AM\\\" ,\\r\\n 11,\\\"11 AM\\\" ,\\r\\n 12,\\\"12 PM (Noon)\\\" ,\\r\\n 13,\\\"1 PM\\\" ,\\r\\n 14,\\\"2 PM\\\" ,\\r\\n 15,\\\"3 PM\\\" ,\\r\\n 16,\\\"4 PM\\\" ,\\r\\n 17,\\\"5 PM\\\" ,\\r\\n 18,\\\"6 PM\\\" ,\\r\\n 19,\\\"7 PM\\\" ,\\r\\n 20,\\\"8 PM\\\" ,\\r\\n 21,\\\"9 PM\\\" ,\\r\\n 22,\\\"10 PM\\\" ,\\r\\n 23,\\\"11 PM\\\" \\r\\n];\\r\\nNewActiveEndHour\\r\\n|project value, label, selected = iff(value == {ActiveEndHour}, true, false)\\r\\n\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e72ccd8d-43cd-4d3d-986e-3dd65151809f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewTimeOffset\",\"label\":\"UTC Time Offset\",\"type\":2,\"query\":\"let NewActiveStartHour = datatable(value:int, label:string)[\\r\\n -12,\\\"-12 Hours\\\",\\r\\n -11,\\\"-11 Hours\\\",\\r\\n -10,\\\"-10 Hours\\\" ,\\r\\n -9,\\\"-9 Hours\\\" ,\\r\\n -8,\\\"-8 Hours\\\" ,\\r\\n -7,\\\"-7 Hours\\\" ,\\r\\n -6,\\\"-6 Hours\\\" ,\\r\\n -5,\\\"-5 Hours\\\" ,\\r\\n -4,\\\"-4 Hours\\\" ,\\r\\n -3,\\\"-3 Hours\\\" ,\\r\\n -2,\\\"-2 Hours\\\" ,\\r\\n -1,\\\"-1 Hour\\\" ,\\r\\n 0,\\\"0 Hours\\\" ,\\r\\n 1,\\\"+1 Hour\\\" ,\\r\\n 2,\\\"+2 Hours\\\" ,\\r\\n 3,\\\"+3 Hours\\\" ,\\r\\n 4,\\\"+4 Hours\\\" ,\\r\\n 5,\\\"+5 Hours\\\" ,\\r\\n 6,\\\"+6 Hours\\\" ,\\r\\n 7,\\\"+7 Hours\\\" ,\\r\\n 8,\\\"+8 Hours\\\" ,\\r\\n 9,\\\"+9 Hours\\\" ,\\r\\n 10,\\\"+10 Hours\\\" ,\\r\\n 11,\\\"+11 Hours\\\" ,\\r\\n 12,\\\"+12 Hours\\\" \\r\\n];\\r\\nNewActiveStartHour\\r\\n|project value, label, selected = iff(value == {TimeOffset}, true, false)\\r\\n\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"61c24dd2-b52e-4002-ac46-045e2f07e355\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MinOverMax\",\"type\":1,\"query\":\"print MinOverMax = iff({NewMinSCU} > {NewMaxSCU}, true, false)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"parameters\":[{\"id\":\"1ffcd520-6411-48c3-a8ed-50c353b3efa5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewHighUsageHours\",\"label\":\"High Usage Hours\",\"type\":1,\"query\":\"let NewActiveDays = dynamic([{NewActiveDays}]);\\r\\nlet NewHighHours = ({NewActiveEndHour} - {NewActiveStartHour})* array_length(NewActiveDays);\\r\\nprint NewHighHours = tostring(NewHighHours)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"2f383967-6870-447d-8370-205672262861\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewLowUsageHours\",\"label\":\"Low Usage Hours\",\"type\":1,\"query\":\"let NewLowUsageHours = (24*7) - tolong({NewHighUsageHours});\\r\\nprint NewLowUsageHours = NewLowUsageHours\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"319da61d-d14d-4588-982e-99d108ae7d26\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewLowSCU\",\"label\":\"Low Total SCU\",\"type\":1,\"query\":\"let LowTotalSCU = {NewLowUsageHours} * {NewMinSCU};\\r\\nprint LowTotalSCU = LowTotalSCU\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"de38bd75-34ae-442e-b1fd-f5522346b9d1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewHighSCU\",\"label\":\"High Total SCU\",\"type\":1,\"query\":\"let HighUsageSCU = tolong({NewHighUsageHours}) * tolong({NewMaxSCU});\\r\\nprint HighUsageSCU = tostring(HighUsageSCU)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"81ae5141-7c19-4d72-8d83-0251d5f002f6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewTotalSCU\",\"label\":\"Total Weekly SCU\",\"type\":1,\"query\":\"let NewTotalSCU = tolong({NewLowSCU}) + tolong({NewHighSCU});\\r\\nprint NewTotalSCU = NewTotalSCU\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"5a91a140-2b88-4e8f-b810-e5533ffbfe8f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewWeeklySCUCost\",\"label\":\"Total Weekly SCU Cost\",\"type\":1,\"query\":\"let NewWeeklySCUCost = tolong({NewTotalSCU}) * tolong({CostPerSCU});\\r\\nprint NewWeeklySCUCost = tostring(NewWeeklySCUCost)\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b78a669f-30c0-4720-b94c-ec6d49966feb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewMonthlySCUCost\",\"label\":\"Total Monthly SCU Cost\",\"type\":1,\"query\":\"let NewMonthlySCUCost = (({NewWeeklySCUCost})/7) * 30;\\r\\nprint NewMonthlySCUCost = NewMonthlySCUCost\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"aac7ddd9-5c17-40ab-9262-954d0ef51a28\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"WeeklyDiff\",\"label\":\"Estimated Weekly Change\",\"type\":1,\"query\":\"let WeeklySCUCost = tolong({TotalSCU}) * tolong({CostPerSCU});\\r\\nlet NewWeeklySCUCost = tolong({NewTotalSCU}) * tolong({CostPerSCU});\\r\\nprint WeeklyDifference = NewWeeklySCUCost - WeeklySCUCost\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"9687f227-0cb5-49b7-a636-05cb76a4df1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"MonthlyDiff\",\"label\":\"Estimated Monthly Change\",\"type\":1,\"query\":\"let WeeklySCUCost = {TotalSCU} * {CostPerSCU};\\r\\nlet NewWeeklySCUCost = {NewTotalSCU} * {CostPerSCU};\\r\\nlet MonthlySCUCost = round(({WeeklySCUCost}/7)*30,0);\\r\\nlet NewMonthlySCUCost = round(({NewWeeklySCUCost}/7)*30,0);\\r\\nprint MonthlyDifference = NewMonthlySCUCost - MonthlySCUCost\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"a5eef48e-d661-44e6-b81f-86363a6f773e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LocalTime\",\"type\":1,\"query\":\"let LocalDate = datetime_add('hour', {NewTimeOffset}, now());\\r\\nprint LocalTime = format_datetime(LocalDate, 'h:mm tt')\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"9739a6a5-6b5c-4290-85db-28cfe659828a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"NewActiveDaysLabel\",\"type\":1,\"query\":\"let ActiveDays= \\\"{NewActiveDays}\\\";\\r\\nprint ActiveDayLabel = ActiveDays\\r\\n| extend ActiveDayLabel = replace_strings(\\r\\n ActiveDays,\\r\\n dynamic(['0', '1', '2', '3', '4', '5', '6']),\\r\\n dynamic([' Sunday', ' Monday', ' Tuesday', ' Wednesday', ' Thursday', ' Friday', 'Saturday']))\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":1,\"content\":{\"json\":\"**Note**\\r\\n - The Minimum SCU value must be less than, or equal to Maximum SCU\",\"style\":\"error\"},\"conditionalVisibility\":{\"parameterName\":\"MinOverMax\",\"comparison\":\"isEqualTo\",\"value\":\"true\"},\"name\":\"text - 3\"},{\"type\":1,\"content\":{\"json\":\"### Validate UTC Offset with Local time:\\r\\n\\r\\n#### Local Time as of last refresh: {LocalTime}\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"**Note**\\r\\n - Make sure you have configured the **UTC Time Offset** value\",\"style\":\"warning\"},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"NewTimeOffset\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"TimeOffsetZero\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"paragraph\",\"links\":[{\"id\":\"1092f1f7-166e-4745-9483-e2adb861f262\",\"linkTarget\":\"ArmAction\",\"linkLabel\":\"Apply Configuration\",\"preText\":\"\",\"style\":\"primary\",\"linkIsContextBlade\":true,\"armActionContext\":{\"path\":\"{ResourceId}/providers/Microsoft.Resources/tags/default?api-version=2022-09-01\",\"headers\":[],\"params\":[],\"body\":\"{\\r\\n \\\"operation\\\": \\\"Merge\\\",\\r\\n \\\"properties\\\": {\\r\\n \\\"tags\\\": {\\r\\n \\\"SecurityCopilotConfig\\\": \\\"{ \\\\\\\"SCULimits\\\\\\\": { \\\\\\\"Min\\\\\\\": {NewMinSCU}, \\\\\\\"Max\\\\\\\": {NewMaxSCU} }, \\\\\\\"Schedule\\\\\\\": { \\\\\\\"ActiveDays\\\\\\\": [{NewActiveDays}], \\\\\\\"ActiveStartHour\\\\\\\": {NewActiveStartHour}, \\\\\\\"ActiveEndHour\\\\\\\": {NewActiveEndHour}, \\\\\\\"TimeOffset\\\\\\\": {NewTimeOffset}}}\\\"\\r\\n }\\r\\n }\\r\\n }\",\"httpMethod\":\"PATCH\",\"title\":\"Add/Modify Security Copilot Resource Tag\",\"description\":\"# This action adds/modifies the Security Copilot resource tags\\n## This change, when paired with the Security Copilot Scaler logic app can impact the performance and costs associated with Security Copilot Compute Capacities\\n\\n## The schedule will be applied the next time the Scaler logic app executes. This can be force by manually running the logic app.\\n\\n## Tag changes will not immediately be reflected in this workbook, and may require 30 seconds before manually refreshing\",\"runLabel\":\"Continue Deploying Schedule\"}}]},\"conditionalVisibility\":{\"parameterName\":\"MinOverMax\",\"comparison\":\"isNotEqualTo\",\"value\":\"true\"},\"name\":\"links - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let StartDate = startofweek(datetime_add(\\\"hour\\\", {NewTimeOffset}, now()));\\r\\nlet EndDate = endofweek(datetime_add(\\\"hour\\\", {NewTimeOffset}, now()));\\r\\nlet ActiveDays=dynamic([{NewActiveDays}]);\\r\\nlet ResourceName = \\\"{ResourceName}\\\";\\r\\nlet MinSCU = toint({NewMinSCU});\\r\\nlet MaxSCU = toint({NewMaxSCU});\\r\\nlet ActiveStartHour = {NewActiveStartHour};\\r\\nlet ActiveEndHour = {NewActiveEndHour};\\r\\nrange TimeDate from StartDate to EndDate step 1h\\r\\n| extend DayofWeek = toint(dayofweek(TimeDate)/1d), HourofDay = hourofday(datetime_add(\\\"hour\\\", {NewTimeOffset}, TimeDate))\\r\\n| extend SCU = iff(DayofWeek in (ActiveDays) and (HourofDay >= ActiveStartHour and HourofDay < ActiveEndHour), MaxSCU, MinSCU)\\r\\n| project-away DayofWeek,HourofDay\",\"size\":1,\"title\":\"Projected weekly schedule for {ResourceName}\",\"color\":\"green\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SCU\",\"color\":\"green\"},{\"seriesName\":\"$_thresholdLine\",\"color\":\"greenDarkDark\"}],\"customThresholdLine\":\"{NewMinSCU}\",\"customThresholdLineStyle\":0,\"ySettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}},\"min\":0}}},\"name\":\"query - 2 - Copy\"},{\"type\":1,\"content\":{\"json\":\"- **Weekly Estimated Cost** calculations are based on the projected schedule\\r\\n\\r\\n- **Monthly Estimated Cost** calculations are based on (Weekly Estimated Cost / 7 days) * 30 days\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"📖Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"help - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"loadType\":\"always\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Scheduled Capacity\"},\"customWidth\":\"50\",\"name\":\"text - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### High Usage Times\"},\"customWidth\":\"50\",\"name\":\"text - 7\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MinMax = datatable(label:string, label2: string, value:string, )[\\r\\n \\\"Low Usage Capacity\\\",\\\"SCU(s)\\\", \\\"{NewMinSCU}\\\",\\r\\n \\\"High Usage Capacity\\\", \\\"SCU(s)\\\", \\\"{NewMaxSCU}\\\"\\r\\n ];\\r\\nMinMax\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},\"rightContent\":{\"columnMatch\":\"label2\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[]}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"\\r\\n> ## {NewActiveDaysLabel}\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 4\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Weekly High Usage SCUs\\\", \\\"{NewHighUsageHours}\\\",\\r\\n \\\"Weekly Low Usage SCUs\\\", \\\"{NewLowUsageHours}\\\",\\r\\n \\\"Weekly Total SCUs\\\", \\\"{NewTotalSCU}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ActiveHours = datatable(label:string, label2: string, value:string, )[\\r\\n \\\"Start Time\\\",\\\"hours\\\", \\\"{NewActiveStartHour}\\\",\\r\\n \\\"End Time\\\",\\\"hours\\\", \\\"{NewActiveEndHour}\\\",\\r\\n \\\"Time Offset from UTC\\\", \\\"hours\\\", \\\"{NewTimeOffset}\\\",\\r\\n ];\\r\\nActiveHours\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"green\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### Cost Estimates\"},\"customWidth\":\"50\",\"name\":\"text - 8\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### Change from Current Schedule\"},\"customWidth\":\"50\",\"name\":\"text - 9\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Cost Per SCU\\\", \\\"{SCUPrice}\\\",\\r\\n \\\"Weekly Estimated Cost\\\", \\\"{NewWeeklySCUCost}\\\",\\r\\n \\\"Monthly Estimated Cost\\\", \\\"{NewMonthlySCUCost}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":0,\"options\":{\"currency\":\"USD\",\"style\":\"currency\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Weekly Change\\\", \\\"{WeeklyDiff}\\\",\\r\\n \\\"Monthly Change\\\", \\\"{MonthlyDiff}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":-1000,\"max\":1000,\"palette\":\"purpleBlueGreen\"},\"numberFormat\":{\"unit\":0,\"options\":{\"currency\":\"USD\",\"style\":\"currency\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50%\"}}]},\"customWidth\":\"100\",\"name\":\"StatGroup - Copy\"}]},\"conditionalVisibilities\":[{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"Edit\"},{\"parameterName\":\"ResourceId\",\"comparison\":\"isNotEqualTo\",\"value\":\"Blank\"}],\"name\":\"EditConfig\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\nlet StartDate = startofweek(datetime_add(\\\"hour\\\", {TimeOffset}, now()));\\r\\nlet EndDate = endofweek(datetime_add(\\\"hour\\\", {TimeOffset}, now()));\\r\\nlet ActiveDays=dynamic([{ActiveDays}]);\\r\\nlet ResourceName = \\\"{ResourceName}\\\";\\r\\nlet MinSCU = {MinSCU};\\r\\nlet MaxSCU = {MaxSCU};\\r\\nlet CurrentSCU = {CurrentSCU};\\r\\nlet ActiveStartHour = {ActiveStartHour};\\r\\nlet ActiveEndHour = {ActiveEndHour};\\r\\nrange TimeDate from StartDate to EndDate step 1h\\r\\n| extend DayofWeek = toint(dayofweek(TimeDate)/1d), HourofDay = hourofday(datetime_add(\\\"hour\\\", {TimeOffset}, TimeDate))\\r\\n| extend SCU = iff(isnotempty(ActiveDays),iff(DayofWeek in (ActiveDays) and (HourofDay >= ActiveStartHour and HourofDay < ActiveEndHour), MaxSCU, MinSCU),CurrentSCU)\\r\\n| project-away DayofWeek,HourofDay\",\"size\":1,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SCU\",\"color\":\"blue\"},{\"seriesName\":\"$_thresholdLine\",\"label\":\"Minimum SCU\",\"color\":\"blueDark\"}],\"customThresholdLine\":\"{MinSCU}\",\"customThresholdLineStyle\":0,\"xSettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"name\":\"query - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"parameters\":[{\"id\":\"180d4c94-2bd1-4f45-ad4a-066074a286fc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActiveDaysLabel\",\"type\":1,\"query\":\"let ActiveDays= \\\"{ActiveDays}\\\";\\r\\nprint ActiveDayLabel = ActiveDays\\r\\n| extend ActiveDayLabel = replace_strings(\\r\\n ActiveDays,\\r\\n dynamic(['0', '1', '2', '3', '4', '5', '6']),\\r\\n dynamic([' Sunday', ' Monday', ' Tuesday', ' Wednesday', ' Thursday', ' Friday', 'Saturday']))\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"loadType\":\"always\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Scheduled Capacity\"},\"customWidth\":\"50\",\"name\":\"text - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### High Usage Times\"},\"customWidth\":\"50\",\"name\":\"text - 7\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let MinMax = datatable(label:string, label2: string, value:string, )[\\r\\n \\\"Low Usage Capacity\\\",\\\"SCU(s)\\\", \\\"{MinSCU}\\\",\\r\\n \\\"High Usage Capacity\\\", \\\"SCU(s)\\\", \\\"{MaxSCU}\\\"\\r\\n ];\\r\\nMinMax\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},\"rightContent\":{\"columnMatch\":\"label2\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[]}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"\\r\\n> ## {ActiveDaysLabel}\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 4\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Weekly High Usage SCUs\\\", \\\"{HighUsageHours}\\\",\\r\\n \\\"Weekly Low Usage SCUs\\\", \\\"{LowUsageHours}\\\",\\r\\n \\\"Weekly Total SCUs\\\", \\\"{TotalSCU}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"purple\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let ActiveHours = datatable(label:string, label2: string, value:string, )[\\r\\n \\\"Start Time\\\",\\\"hours\\\", \\\"{ActiveStartHour}\\\",\\r\\n \\\"End Time\\\",\\\"hours\\\", \\\"{ActiveEndHour}\\\",\\r\\n \\\"Time Offset from UTC\\\", \\\"hours\\\", \\\"{TimeOffset}\\\",\\r\\n ];\\r\\nActiveHours\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"green\"},\"numberFormat\":{\"unit\":26,\"options\":{\"style\":\"decimal\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### Cost Estimates\"},\"customWidth\":\"100\",\"name\":\"text - 8\",\"styleSettings\":{\"maxWidth\":\"100%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Cost Per SCU\\\", \\\"{SCUPrice}\\\",\\r\\n \\\"Weekly Estimated Cost\\\", \\\"{WeeklySCUCost}\\\",\\r\\n \\\"Monthly Estimated Cost\\\", \\\"{MonthlySCUCost}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"crossComponentResources\":[\"{LogAnalyticsWorkspace}\"],\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":0,\"options\":{\"currency\":\"USD\",\"style\":\"currency\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}}]},\"customWidth\":\"100\",\"name\":\"StatGroup - ViewGroup\"}],\"exportParameters\":true},\"conditionalVisibilities\":[{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"View\"},{\"parameterName\":\"ResourceId\",\"comparison\":\"isNotEqualTo\",\"value\":\"Blank\"},{\"parameterName\":\"HasConfig\",\"comparison\":\"isEqualTo\",\"value\":\"1\"}],\"name\":\"ViewScheduleGroup\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\nlet StartDate = startofweek(datetime_add(\\\"hour\\\", {TimeOffset}, now()));\\r\\nlet EndDate = endofweek(datetime_add(\\\"hour\\\", {TimeOffset}, now()));\\r\\nlet ActiveDays=dynamic([{ActiveDays}]);\\r\\nlet ResourceName = \\\"{ResourceName}\\\";\\r\\nlet MinSCU = {MinSCU};\\r\\nlet MaxSCU = {MaxSCU};\\r\\nlet CurrentSCU = {CurrentSCU};\\r\\nlet ActiveStartHour = {ActiveStartHour};\\r\\nlet ActiveEndHour = {ActiveEndHour};\\r\\nrange TimeDate from StartDate to EndDate step 1h\\r\\n| extend DayofWeek = toint(dayofweek(TimeDate)/1d), HourofDay = hourofday(datetime_add(\\\"hour\\\", {TimeOffset}, TimeDate))\\r\\n| extend SCU = iff(isnotempty(ActiveDays),iff(DayofWeek in (ActiveDays) and (HourofDay >= ActiveStartHour and HourofDay < ActiveEndHour), MaxSCU, MinSCU),CurrentSCU)\\r\\n| project-away DayofWeek,HourofDay\",\"size\":1,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"SCU\",\"color\":\"blue\"},{\"seriesName\":\"$_thresholdLine\",\"label\":\"Minimum SCU\",\"color\":\"blueDark\"}],\"customThresholdLine\":\"{MinSCU}\",\"customThresholdLineStyle\":0,\"xSettings\":{\"numberFormatSettings\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}},\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"name\":\"query - 6\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"loadType\":\"always\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Configured Capacity\"},\"customWidth\":\"50\",\"name\":\"text - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":1,\"content\":{\"json\":\"### Cost Estimates\"},\"customWidth\":\"50\",\"name\":\"text - 8\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let SCUCapacity = datatable(label:string, label2: string, value:string, )[\\r\\n \\\"Hourly Capacity\\\",\\\"SCU(s)\\\", \\\"{CurrentSCU}\\\",\\r\\n \\\"Weekly Total SCUs\\\",\\\"SCU(s)\\\", \\\"{TotalSCU}\\\"\\r\\n ];\\r\\nSCUCapacity\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}},\"rightContent\":{\"columnMatch\":\"label2\",\"formatter\":1,\"formatOptions\":{\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[]}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Summaries = datatable(label:string,value:string, )[\\r\\n \\\"Cost Per SCU\\\", \\\"{SCUPrice}\\\",\\r\\n \\\"Weekly Estimated Cost\\\", \\\"{WeeklySCUCost}\\\",\\r\\n \\\"Monthly Estimated Cost\\\", \\\"{MonthlySCUCost}\\\"\\r\\n ];\\r\\nSummaries\",\"size\":4,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"label\"},\"leftContent\":{\"columnMatch\":\"value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"turquoise\"},\"numberFormat\":{\"unit\":0,\"options\":{\"currency\":\"USD\",\"style\":\"currency\"}}},\"showBorder\":false}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50%\"}}]},\"customWidth\":\"100\",\"name\":\"StatGroup - ViewGroup\"}],\"exportParameters\":true},\"conditionalVisibilities\":[{\"parameterName\":\"Nav\",\"comparison\":\"isEqualTo\",\"value\":\"View\"},{\"parameterName\":\"ResourceId\",\"comparison\":\"isNotEqualTo\",\"value\":\"Blank\"},{\"parameterName\":\"HasConfig\",\"comparison\":\"isNotEqualTo\",\"value\":\"1\"}],\"name\":\"ViewNoScheduleGroup\"}],\"isLocked\":false,\"fromTemplateId\":\"sentinel-UserWorkbook\"}",
- "version": "1.0",
- "sourceId": "[concat('/subscriptions/',subscription().subscriptionId,'/resourcegroups/',parameters('sentinelResourceGroup'),'/providers/Microsoft.OperationalInsights/workspaces/',parameters('sentinelWorkspaceName'))]",
- "category": "sentinel"
- }
- }
- ]
- },
- "parameters": {}
- }
- }
- ]
-}
diff --git a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml
index 1bd8fffc..ca869f2f 100644
--- a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml
+++ b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml
@@ -22,10 +22,10 @@ Descriptor:
SettingType: String
Required: true
- - Name: SubscriptionName
- Label: SubscriptionName
- Description: This is the subscription name that security copilot will use for sentinel.
- HintText: yoursubscriptionname
+ - Name: SubscriptionId
+ Label: SubscriptionId
+ Description: This is the subscription ID that security copilot will use for sentinel.
+ HintText: SubscriptionId
SettingType: String
Required: true
@@ -130,7 +130,7 @@ SkillGroups:
Settings:
Target: Sentinel
TenantId: "{{TenantId}}"
- SubscriptionName: "{{SubscriptionName}}"
+ SubscriptionId: "{{SubscriptionId}}"
ResourceGroupName: "{{ResourceGroupName}}"
WorkspaceName: "{{WorkspaceName}}"
Template: |-
@@ -176,7 +176,6 @@ SkillGroups:
- Name: DeviceCVESearch
DisplayName: Device CVE Search
DescriptionForModel: |-
- Identify specific CVEs affecting a specified device based on the selected severity level. For each vulnerability, it:
Identify specific CVEs affecting a specified device based on the selected severity level. For each vulnerability, it:
1. **Analyzes Software Vendors**: Evaluates the type of software the vendor produces and the potential risks associated with the vulnerability, considering the software's role in the system and possible exploitation impacts.
2. **Summarizes Device Security State**: Assesses the device's security posture by reviewing the number and severity of CVEs and identifying critical areas requiring immediate attention.
@@ -209,18 +208,6 @@ SkillGroups:
IsExploitAvailable
| order by EpssScore desc, CvssScore desc
- | lookup DeviceTvmSoftwareVulnerabilitiesKB on CveId
- | project
- DeviceName,
- SoftwareVendor,
- SoftwareName,
- CveId,
- CvssScore,
- EpssScore,
- CvssVector,
- IsExploitAvailable
- | order by EpssScore desc, CvssScore desc
-
- Name: CVEHostSearch
DisplayName: CVE Host Search
diff --git a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/USERENRICHMENT.md b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/USERENRICHMENT.md
index 5c7b2519..8ad23517 100644
--- a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/USERENRICHMENT.md
+++ b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/USERENRICHMENT.md
@@ -2,58 +2,93 @@
**Author: Craig Freyman**
## User Enrichment Plugin
-This suite of enrichment skills is designed to enhance security investigations by providing detailed insights into user activities, such as login behavior, password changes, MFA modifications, location analysis, and mailbox activities. By leveraging these tools, security teams can identify potential threats, monitor user risks, and respond to suspicious behavior effectively.
+This suite of enrichment skills is designed to enhance security investigations by providing detailed insights into user activities, such as login behavior, password changes, MFA modifications, location analysis, mailbox activities, and IP-based sign-in tracking. By leveraging these tools, security teams can identify potential threats, monitor user risks, and respond to suspicious behavior effectively.
+
+---
### UnusualSigninActivity
Identify unusual sign-in patterns for a specific user based on anomalies such as high-risk locations, login failures, and sudden changes in device, application, or IP address usage. Highlights deviations from normal behavior and provides recommendations for security actions.
-Example Prompt: Identify unusual sign-in patterns for mscott@paper.com
+**Example Prompt**: Identify unusual sign-in patterns for mscott@paper.com.
+
+---
### PasswordChangeCount
Analyze the number of password changes for a specific user over the past 7 days. Identify potential security threats, such as account compromise or phishing attacks, by detecting anomalies in password change patterns.
-Example Prompt: Detect recent password changes for mscott@paper.com over the past 7 days.
+**Example Prompt**: Detect recent password changes for mscott@paper.com over the past 7 days.
+
+---
### RecentMFAChanges
Track recent MFA changes for a user, identifying added, removed, or modified authentication methods. Provides detailed insights into changes and highlights anomalies.
-Example Prompt: Track MFA changes for mscott@paper.com in the last 7 days.
+**Example Prompt**: Track MFA changes for mscott@paper.com in the last 7 days.
+
+---
### UserHomeOfficeLocation
Retrieve and compare a user's home office location (city, country, state) with recent sign-in locations to detect unusual activity. Highlights deviations that may indicate unauthorized access.
-Example Prompt: Compare home office location with sign-in patterns for mscott@paper.com.
+**Example Prompt**: Compare home office location with sign-in patterns for mscott@paper.com.
+
+---
### UserSigninBaseline
Establish a baseline of a user's typical sign-in activity over the past 30 days, including their most frequently used IP address, location, device, application, and client application. Detect deviations to identify potential security risks.
-Example Prompt: Establish sign-in baseline for mscott@paper.com over the last 30 days.
+**Example Prompt**: Establish sign-in baseline for mscott@paper.com over the last 30 days.
+
+---
### FailedUserSignInSpecificDay
-Identify failed sign-in attempts for a specific user over a defined lookback period. Provides insights into failed attempts, including timestamps, IP addresses, and failure reasons.
+Identify failed sign-in attempts for a specific user over a defined lookback period. Provides insights into failed attempts, including timestamps, IP addresses, locations, and failure reasons.
-Example Prompt: Identify failed sign-in attempts for mscott@paper.com in the last 7 days.
+**Example Prompt**: Identify failed sign-in attempts for mscott@paper.com in the last 7 days.
-### UserRiskDetections
-Analyze and prioritize medium and high-risk detections for a specific user over the past 7 days. Provides insights into risk events, such as risk types, details, and locations.
+---
-Example Prompt: Analyze medium and high-risk events for mscott@paper.com in the last 7 days.
+### EnhancedUserRiskAssessment
+Combine user risk events, recent sign-ins, high-risk user indicators, and security alerts to deliver detailed context around risky user activities for a specific user. Supports threat detection, incident prioritization, and remediation planning.
-### HighRiskUserDetection
-Identify high-risk users with recent activity by correlating risk events and user status. Focus on unresolved risks and prioritize remediation steps.
+**Example Prompt**: Fetch enhanced user risk details for mscott@paper.com.
-Example Prompt: Identify high-risk user activity for mscott@paper.com in the past week.
+---
### ImpossibleTravel
-Detect impossible travel by analyzing login patterns and identifying logins from geographically distant locations within an unrealistically short time frame.
+Detect impossible travel by analyzing login patterns and identifying logins from geographically distant locations within an unrealistically short time frame. Supports detection of potential credential misuse.
-Example Prompt: Detect impossible travel events for mscott@paper.com in the past 7 days.
+**Example Prompt**: Detect impossible travel events for mscott@paper.com in the past 7 days.
+
+---
### SuspiciousMailboxActivities
Investigate recent mailbox activities to detect potential security threats, such as:
-- Newly created or modified rules that redirect or filter emails suspiciously.
-- Mailbox permissions changes that might indicate unauthorized access.
+- Newly created or modified inbox rules that redirect or filter emails suspiciously.
+- Mailbox permission changes that might indicate unauthorized access.
Focus on identifying anomalies that could lead to exfiltration or business email compromise (BEC) attempts.
-Example Prompt: Investigate suspicious mailbox activities for mscott@test.com in the last 30 days.
+**Example Prompt**: Investigate suspicious mailbox activities for mscott@test.com in the last 30 days.
+
+---
+
+### DailyEntraIDRiskDetectionReview
+Summarize and prioritize Entra ID risk detections from the past day, highlighting interesting or critical alerts that may require SOC analyst review.
+
+**Example Prompt**: Summarize Entra ID risk detections from the past 24 hours.
+
+---
+
+### SuccessfulLoginsFromIP
+Find all successful user sign-ins originating from a specified IP address. Returns detailed event information including timestamp, user, location, device, and application.
+
+**Example Prompt**: List all successful logins from 1.2.3.4.
+
+---
+
+### SuccessfulLoginCountFromIP
+Return the total number of successful sign-in attempts from a given IP address. Useful for quickly determining if a specific IP has ever been successfully used.
+
+**Example Prompt**: Count successful logins from 1.2.3.4.
+---
diff --git a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/UserEnrichment.yaml b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/UserEnrichment.yaml
index f19c17fa..a941e497 100644
--- a/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/UserEnrichment.yaml
+++ b/Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/UserEnrichment.yaml
@@ -30,6 +30,14 @@ SkillGroups:
- Name: upn
Description: User principal name, e.g., mscott@woodgrove.ms
Required: true
+ - Name: exclude_ip
+ Description: Any IP address that should be excluded from the results.
+ Default: ""
+ Required: false
+ - Name: unusualsignin_context
+ Description: Additional context to tune the output appropriately
+ Default: ""
+ Required: false
Settings:
Target: Defender
Template: |-
@@ -37,11 +45,13 @@ SkillGroups:
// It analyzes login patterns, focusing on anomalies such as high failure rates, sign-ins from unfamiliar IPs or devices, or abnormal client applications.
// Deviations from the usual patterns may indicate suspicious activity, prompting security actions like MFA review or password reset.
// The output includes IP addresses, device IDs, and user agents to assist in identifying unusual behavior.
+ // The additional requests from the user are {{unusualsignin_context}}
let UPN = "{{upn}}"; // Replace with the specific users upn
let TimeFrame = ago(30d);
// Retrieve and summarize the user's login activity, focusing on successful vs failed attempts and identifying unusual patterns.
SigninLogs
| where TimeGenerated > TimeFrame
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| where UserPrincipalName =~ UPN
| summarize FirstSeen = min(TimeGenerated), LastObserved = max(TimeGenerated), SuccessfullCount = count(ResultType = 0), FailureCount = count(ResultType != 0)
by UserPrincipalName, IPAddress, Location, tostring(DeviceDetail.deviceId), UserAgent, ClientAppUsed, AppDisplayName
@@ -222,30 +232,42 @@ SkillGroups:
- Name: upn
Description: User principle name. i.e., mscott@woodgrove.ms
Required: true
+ - Name: exclude_ip
+ Description: Any IP address that should be excluded from the results.
+ Default: ""
+ Required: false
+ - Name: usersignin_context
+ Description: Additional context to tune the output appropriately
+ Default: ""
+ Required: false
Settings:
Target: Defender
Template: |-
+ // The additional context from the user is {{usersignin_context}}
// This query establishes a baseline for a user's sign-in activity over the past 30 days by identifying the most frequently used IP address, location, device, application, and client application.
// It helps detect deviations that may indicate suspicious behavior, such as sign-ins from unfamiliar locations, new devices, or different apps.
// Anomalies can point to account compromise or unauthorized access, triggering actions like MFA enforcement or security reviews.
// The query outputs the user's typical behavior patterns and highlights any deviations.
// Provide a summary of the users baseline and analyze any deviations, recommending actions like enforcing MFA, resetting credentials, or initiating further security reviews if abnormal patterns are detected.
+ // The additional context from the user is {{usersignin_context}}
let UPN = "{{upn}}"; // Replace with the specific users email
let TimeFrame = ago(30d);
// Identify the most frequently used IP address for the user.
let MostCommonIP = toscalar(
- SigninLogs
- | where TimeGenerated > TimeFrame
- | where UserPrincipalName =~ UPN
- | summarize IPCount = count() by IPAddress
- | top 1 by IPCount desc
- | project IPAddress
+ SigninLogs
+ | where TimeGenerated > TimeFrame
+ | where UserPrincipalName =~ UPN
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
+ | summarize IPCount = count() by IPAddress
+ | top 1 by IPCount desc
+ | project IPAddress
);
// Identify the most frequently used location (e.g., city, country) for the user.
let MostCommonLocation = toscalar(
SigninLogs
| where TimeGenerated > TimeFrame
| where UserPrincipalName =~ UPN
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| summarize LocationCount = count() by Location
| top 1 by LocationCount desc
| project Location
@@ -255,6 +277,7 @@ SkillGroups:
SigninLogs
| where TimeGenerated > TimeFrame
| where UserPrincipalName =~ UPN
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| summarize DeviceCount = count() by tostring(DeviceDetail.deviceId)
| top 1 by DeviceCount desc
| project tostring(DeviceDetail_deviceId)
@@ -263,6 +286,7 @@ SkillGroups:
let MostCommonApp = toscalar(
SigninLogs
| where TimeGenerated > TimeFrame
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| where UserPrincipalName =~ UPN
| summarize AppCount = count() by AppDisplayName
| top 1 by AppCount desc
@@ -272,6 +296,7 @@ SkillGroups:
let MostCommonClientApp = toscalar(
SigninLogs
| where TimeGenerated > TimeFrame
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| where UserPrincipalName =~ UPN
| summarize ClientAppCount = count() by ClientAppUsed
| top 1 by ClientAppCount desc
@@ -314,92 +339,123 @@ SkillGroups:
- Name: lookback_period
Description: The time range to look back. i.e., 1d, 7d, 30d (default is 1d)
Required: false
+ - Name: exclude_ip
+ Description: Any IP address that should be excluded from the results.
+ Default: ""
+ Required: false
Settings:
Target: Defender
Template: |-
SigninLogs
| where TimeGenerated >= ago(1d) // Specify the lookback_period, default 1d
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| where ResultType != 0 // Filtering for failed sign-ins; 0 indicates success
| where UserPrincipalName == "{{upn}}"
| summarize FailedAttempts = count(), UniqueIPs = dcount(IPAddress), Locations = dcount(Location), ResultDescriptions = makeset(ResultDescription) by bin(TimeGenerated, 1d)
| project TimeGenerated, FailedAttempts, UniqueIPs, Locations, ResultDescriptions
| order by TimeGenerated desc
- - Name: UserRiskDetections
- DisplayName: Entra User Risk Detections
- Description: "Analyze risk events for a specific user by joining user risk detections with security alerts to provide enriched insights. This query identifies and correlates risk activities with security alerts, highlighting types, details, timing, and severity. It supports detailed investigations by surfacing connected risks and alerts for prioritization and actionable response."
- DescriptionForModel: |-
- Performs a KQL query on the AADUserRiskEvents table, filtering for a specified user's principal name (UserPrincipalName) and joining with the SecurityAlert table to correlate user risk events with associated security alerts. Key features include:
-
- - **Risk and Alert Correlation**:
- - Links risk events (Id) with related security alerts (VendorOriginalId) for enhanced context.
- - Provides detailed information on RiskLevel, RiskDetail, and RiskState alongside alert-specific data like AlertName, AlertSeverity, and CompromisedEntity.
-
- - **User-Focused Insights**:
- - Focuses on a single user's activity, helping analysts investigate incidents involving that user.
- - Highlights the date and time of events (ActivityDateTime and StartTime) for timeline reconstruction.
-
- - **Enhanced Investigation**:
- - Surfaces patterns in risk and alert data, aiding in anomaly detection and prioritization.
- - Supports actions like user-specific remediations and incident containment.
-
- This skill enables efficient monitoring and investigation of user-specific risks and alerts, helping prioritize and mitigate potential threats effectively.
-
+ - Name: EnhancedUserRiskAssessment
+ DisplayName: Enhanced User Risk Assessment
+ Description: >
+ Combines user risk events, recent sign-ins, high-risk user indicators, and security alerts to deliver detailed context around risky user activities for a specific user. Useful for threat detection, incident prioritization, and remediation planning.
Inputs:
- Name: upn
- Description: The UPN to search for. For example, mscott@dunder.com
+ Description: User principal name. i.e., mscott@woodgrove.ms
Required: true
+ ExamplePrompt:
+ - "Get enhanced user risk details"
+ - "Fetch detailed user risk assessment"
+ - "Run comprehensive user risk check"
Settings:
Target: Defender
Template: |-
- AADUserRiskEvents
- | where TimeGenerated > ago(7d)
- | where UserPrincipalName == "{{upn}}"
- | join kind=inner (SecurityAlert) on $left.Id == $right.VendorOriginalId
-
- - Name: HighRiskUserDetection
- DisplayName: High-Risk User Detection
- Description: Identify high-risk users with recent activity by correlating risk events and user status. Highlights unresolved risks, focusing on key details such as risk type, IP address, and recent activity for prioritizing remediation steps.
- DescriptionForModel: |-
- Performs a KQL query to analyze high-risk users by joining the `AADRiskyUsers` and `AADUserRiskEvents` tables. Key features include:
-
- - **Risk Correlation**:
- - Retrieves recent high-risk events (`DetectedDateTime` within the last 7 days) for a specified user.
- - Joins data with high-risk user statuses from `AADRiskyUsers` to focus on unresolved risks.
-
- - **Detailed Insights**:
- - Columns include:
- - `RiskEventType`: Type of risk detected.
- - `RiskDetail`: Specific details about the risk.
- - `IpAddress`: Location associated with risky activity.
- - `DetectedDateTime`: Timestamp of the detection.
- - `RiskLastUpdatedDateTime`: Last update time for the user's risk status.
-
- - **Prioritization**:
- - Orders results by `RiskLastUpdatedDateTime` to highlight users with the most recent unresolved high-risk activity.
- - Ensures focus on persistent risks and users requiring immediate action.
-
- - **Goal**:
- - Enables security analysts to identify patterns of risky behavior, such as multiple high-risk sign-ins or repeated attempts from unusual locations.
- - Supports prioritized investigations and swift remediation actions, such as enforcing MFA, reviewing user activity, or disabling accounts.
+ let TimeFrame = ago(7d);
+ let upn = "{{upn}}";
+ let UserRiskEvents = AADUserRiskEvents
+ | where TimeGenerated > TimeFrame and RiskLevel != "none" and RiskState != "remediated" and UserPrincipalName == upn
+ | project
+ UserPrincipalName,
+ RiskLevel,
+ RiskEventType,
+ RiskDetail,
+ Activity,
+ ActivityDateTime,
+ DetectedDateTime,
+ IpAddress,
+ Location,
+ RiskState,
+ Id,
+ CorrelationId;
+ let RecentSignIns = SigninLogs
+ | where TimeGenerated > TimeFrame
+ | project
+ SignInId = Id,
+ UserPrincipalName,
+ SignInTime = TimeGenerated,
+ ResultType,
+ ResultDescription,
+ AppDisplayName,
+ ClientAppUsed,
+ SignInIPAddress = IPAddress,
+ SignInLocationDetails = LocationDetails,
+ DeviceDetail,
+ RiskLevelDuringSignIn,
+ ConditionalAccessStatus,
+ AuthenticationMethodsUsed,
+ CorrelationId;
+ let HighRiskUsers = AADRiskyUsers
+ | where TimeGenerated > TimeFrame and RiskLevel in ("high", "medium")
+ | project
+ UserPrincipalName,
+ UserRiskLevel = RiskLevel,
+ RiskState,
+ RiskLastUpdatedDateTime;
+ let Alerts = SecurityAlert
+ | where TimeGenerated > TimeFrame
+ | project
+ AlertName,
+ AlertSeverity,
+ CompromisedEntity,
+ AlertStartTime = StartTime,
+ AlertEndTime = EndTime,
+ VendorOriginalId;
+ UserRiskEvents
+ | join kind=leftouter RecentSignIns on CorrelationId
+ | join kind=leftouter HighRiskUsers on UserPrincipalName
+ | join kind=leftouter Alerts on $left.Id == $right.VendorOriginalId
+ | project
+ UserPrincipalName,
+ RiskLevel,
+ RiskEventType,
+ RiskDetail,
+ RiskState,
+ Activity,
+ ActivityDateTime,
+ DetectedDateTime,
+ IpAddress,
+ Location,
+ SignInTime,
+ ResultType,
+ ResultDescription,
+ AppDisplayName,
+ ClientAppUsed,
+ SignInIPAddress,
+ SignInLocationDetails,
+ DeviceDetail,
+ RiskLevelDuringSignIn,
+ ConditionalAccessStatus,
+ AuthenticationMethodsUsed,
+ UserRiskLevel,
+ RiskLastUpdatedDateTime,
+ AlertName,
+ AlertSeverity,
+ CompromisedEntity,
+ AlertStartTime,
+ AlertEndTime
+ | order by RiskLevel desc, DetectedDateTime desc
+ | take 10
- This skill helps analysts detect and respond to unresolved risks in high-risk users effectively.
- Inputs:
- - Name: upn
- Description: The UPN to search for. For example, mscott@dunder.com
- Required: true
- Settings:
- Target: Defender
- Template: |-
- let recentEvents = AADUserRiskEvents
- | where DetectedDateTime > ago(7d)
- | where RiskLevel == "high"
- | where UserPrincipalName == "{{upn}}"
- | project UserPrincipalName, Activity, DetectedDateTime, RiskEventType, RiskDetail, IpAddress;
- AADRiskyUsers
- | where RiskLevel == "high"
- | join kind=inner (recentEvents) on UserPrincipalName
- | order by RiskLastUpdatedDateTime desc
- Name: ImpossibleTravel
DisplayName: Impossible Travel
@@ -432,6 +488,10 @@ SkillGroups:
- Name: upn
Description: The UPN (User Principal Name) to search for.
Required: true
+ - Name: exclude_ip
+ Description: Any IP address that should be excluded from the results.
+ Default: ""
+ Required: false
Settings:
Target: Defender
Template: |-
@@ -450,6 +510,7 @@ SkillGroups:
SigninLogs
| where ResultType == 0 // Filter for successful logins
| where TimeGenerated > ago(7d)
+ | where IPAddress != "{{exclude_ip}}" // exclude_ip from query
| extend LocationDetails = parse_json(LocationDetails) // Parse location details
| extend Latitude = tostring(LocationDetails.geoCoordinates.latitude),
Longitude = tostring(LocationDetails.geoCoordinates.longitude),
@@ -504,4 +565,95 @@ SkillGroups:
| extend packed = pack(Name, Value)
| where Parameters has_any("DeleteMessage") or (Parameters has_any("MoveToFolder") and Parameters has_any("Conversation History"))
| summarize PackedInfo = make_bag(packed), ActionType=any(ActionType) by UPN, AccountObjectId, IPAddress, ISP, ReportId, TimeGenerated
- | evaluate bag_unpack(PackedInfo)
\ No newline at end of file
+ | evaluate bag_unpack(PackedInfo)
+
+ - Name: DailyEntraIDRiskDetectionReview
+ DisplayName: Daily Entra ID Risk Detection Review
+ DescriptionForModel: |-
+ Performs a KQL query on the `AADUserRiskEvents` table to summarize Entra ID risk detections from the previous day. Key features include:
+ - **Risk Detection Summary**: Groups risk events by `RiskEventType`, `RiskLevel`, `Activity`, `RiskDetail`, and `DetectionTimingType`.
+ - **Prioritization**: Assigns priority based on the severity and frequency of events:
+ - High priority for infrequent, high-risk detections.
+ - Medium priority for moderate-risk detections.
+ - Low priority for common or lower-severity detections.
+ - **Detailed Insights**:
+ - Total number of detections.
+ - Number of impacted users.
+ - Time range of detected risks (`FirstDetected`, `LastDetected`).
+ - **Actionable Recommendations**: Highlights detections of interest that may require further investigation or review, assisting analysts in identifying overlooked or significant risk events.
+ This skill aids security teams in efficiently reviewing and prioritizing Entra ID risk detections daily, reducing alert fatigue and ensuring critical threats are investigated.
+ Description: Summarize and prioritize Entra ID risk detections from the past day, highlighting interesting or critical alerts that may require SOC analyst review. Results include impactedUPNs if further analysis is required.
+ Settings:
+ Target: Defender
+ Template: |-
+ // Summarizes and prioritizes Entra ID risk detections from the previous day.
+ let TimeFrame = ago(1d);
+ AADUserRiskEvents
+ | where TimeGenerated >= TimeFrame
+ | summarize
+ TotalDetections = count(),
+ ImpactedUsers = dcount(UserPrincipalName),
+ ImpactedUPNs = make_set(UserPrincipalName, 50), // Include impacted users explicitly
+ FirstDetected = min(DetectedDateTime),
+ LastDetected = max(DetectedDateTime)
+ by RiskEventType, RiskLevel, Activity, RiskDetail, DetectionTimingType, Source
+ | extend RiskPriority = case(
+ RiskLevel == "high" and TotalDetections < 10, "High",
+ RiskLevel == "medium" and TotalDetections < 5, "Medium",
+ "Low")
+ | order by RiskPriority asc, TotalDetections asc
+
+ - Name: SuccessfulLoginsFromIP
+ DisplayName: Successful Logins from an IP
+ DescriptionForModel: |
+ Perform a KQL query to identify all successful sign-in events from a specified IP address. Provides full event details including timestamp, user, location, device, and app information.
+ Description: Find all successful user sign-ins originating from a specified IP address.
+ Inputs:
+ - Name: ip_address
+ Description: IP address to search for. Example 1.2.3.4
+ Required: true
+ - Name: additional_context
+ Description: Any additional context for security copilot
+ Required: false
+ Settings:
+ Target: Defender
+ Template: |-
+ //Query to return known successful connnections from a particular IP address.
+ //Useful for troubleshooting false vs true positive alerts
+ //Here is any additional user context: {{additional_context}}
+ let TargetIP = "{{ip_address}}"; // Target IP address for investigation
+ SigninLogs
+ | where IPAddress == TargetIP // Filter events matching the specified IP
+ | where ResultType == 0 // Keep only successful sign-in events (ResultType = 0)
+ | project
+ TimeGenerated, // Time of the sign-in
+ UserPrincipalName, // User who signed in
+ IPAddress, // IP address used
+ Location, // Geolocation (if available)
+ DeviceDetail, // Device information
+ AppDisplayName, // Application accessed
+ ClientAppUsed // Client app used (browser, native app, etc.)
+ | order by TimeGenerated desc // Show newest events first
+
+ - Name: SuccessfulLoginCountFromIP
+ DisplayName: Successful Login Count from an IP
+ DescriptionForModel: |
+ Perform a KQL query to check if there have been any successful sign-ins from a specified IP address. Returns the number of successful events.
+ Description: Return the total number of successful sign-in attempts from a given IP address.
+ Inputs:
+ - Name: ip_address
+ Description: IP address to search for. Example 1.2.3.4
+ Required: true
+ - Name: additional_context
+ Description: Any additional context for security copilot
+ Required: false
+ Settings:
+ Target: Defender
+ Template: |-
+ //Query to count how many successful logins from a particular IP address to give additional perspective to help with troubleshooting true vs fales positive login events.
+ //Here is any additional user context: {{additional_context}}
+ let TargetIP = "{{ip_address}}"; // Target IP address for counting successful logins
+ SigninLogs
+ | where IPAddress == TargetIP // Filter events matching the specified IP
+ | where ResultType == 0 // Keep only successful sign-in events
+ | summarize SuccessCount = count() // Return the number of successful sign-ins
diff --git a/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevices-OpenAPISpec.yaml b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevices-OpenAPISpec.yaml
new file mode 100644
index 00000000..ed43098f
--- /dev/null
+++ b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevices-OpenAPISpec.yaml
@@ -0,0 +1,101 @@
+openapi: 3.0.0
+
+# This section provides metadata about the plugin, including its title, description, and version.
+info:
+ title: Retrieve devices onboarded into Microsoft Defender for Endpoint (MDE)
+ description: Plugin to retrieve a list of devices onboarded into Microsoft Defender for Endpoint (MDE) using Microsoft Graph API.
+ version: 1.0.0
+
+# Defines the base URL for the Microsoft Graph API, which is used to make requests.
+servers:
+ - url: https://graph.microsoft.com/v1.0
+ description: Microsoft Graph API url
+
+# Specifies the available API endpoints and their operations, in this case, retrieving a list of devices.
+paths:
+ /devices:
+ get:
+ summary: Get devices
+ description: Retrieve a list of devices onboarded into Microsoft Defender for Endpoint
+ responses:
+ '200':
+ description: List of devices
+ content:
+ application/json:
+ schema:
+ type: object
+ properties:
+ value:
+ type: array
+ items:
+ type: object
+ properties:
+ id:
+ type: string
+ description: Device ID.
+ deviceName:
+ type: string
+ description: Name of the device.
+ osPlatform:
+ type: string
+ description: Operating system of the device.
+ complianceState:
+ type: string
+ description: Compliance state of the device.
+ lastSeenDateTime:
+ type: string
+ format: date-time
+ description: Last seen date and time.
+ onboardedDate:
+ type: string
+ format: date
+ description: Date the device was onboarded.
+ manufacturer:
+ type: string
+ description: Manufacturer of the device.
+ model:
+ type: string
+ description: Model of the device.
+ serialNumber:
+ type: string
+ description: Serial number of the device.
+ macAddress:
+ type: string
+ description: MAC address of the device.
+ ipAddress:
+ type: string
+ description: IP address of the device.
+ isAzureAdJoined:
+ type: boolean
+ description: Indicates if the device is Azure AD joined.
+ isCompliant:
+ type: boolean
+ description: Indicates if the device is compliant.
+ riskLevel:
+ type: string
+ description: Risk level assigned to the device.
+ '401':
+ description: Unauthorized error.
+ '403':
+ description: Forbidden access.
+ '500':
+ description: Internal server error.
+
+# Defines security mechanisms, such as authentication methods, that the API uses.
+components:
+ securitySchemes:
+ bearerAuth:
+ type: http
+ scheme: bearer
+
+security:
+ - bearerAuth: []
+
+# Provides example natural language queries that users can use to interact with the API via Security Copilot and retrieve specific device information.
+x-example-prompts:
+ - Retrieve devices onboarded to MDE that have a compliance state of 'Non-compliant'
+ - Get the list of non-compliant devices from devices onboarded to MDE
+ - retrieve a list of devices onboarded onto MDE that have a Risk Level of "High"
+ - Retrieve devices from MDE that registered less than 14 days ago from today
+ - Retrieve a list of MDE endpoints that were last seen less than 1 day ago
+ - Get devices from MDE that have the IoS operating system
diff --git a/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevicesPlugin.yaml b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevicesPlugin.yaml
new file mode 100644
index 00000000..36e2dc79
--- /dev/null
+++ b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/MDEOnboardedDevicesPlugin.yaml
@@ -0,0 +1,13 @@
+Descriptor:
+ Name: RetrieveMDEOnboardedDevices
+ DisplayName: Retrieve details for devices onboarded onto Microsoft Defender for Endpoint (MDE)
+ Description: Retrieve details for devices onboarded onto Microsoft Defender for Endpoint (MDE)
+ DescriptionForModel: Retrieves detailed information about devices onboarded into Microsoft Defender for Endpoint (MDE),including device name, operating system, compliance state, risk level, last seen timestamp,onboarded date, manufacturer, model, serial number, IP address, MAC address, and Azure AD join status.This API enables security analysts to assess device security posture, identify non-compliant or high-risk devices,and correlate endpoint data with ongoing security incidents. Results provide actionable insights for threat detection, response, and asset visibility within enterprise environments, supporting Security Copilot in enhancing situational awareness and proactive threat mitigation.
+
+ Authorization:
+ Type: AADDelegated
+ EntraScopes: https://graph.microsoft.com/.default
+SkillGroups:
+ - Format: API
+ Settings:
+ OpenApiSpecUrl: https://gist.githubusercontent.com/inwafula/88a0e5b5f3a2bdc1840771b97937d8f0/raw/ff2211080321d6e74881ab960d9c2e0f060f3e28/MDEOnboardedDevices-OpenAPISpec.yaml
\ No newline at end of file
diff --git a/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/Readme.md b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/Readme.md
new file mode 100644
index 00000000..b0fc1399
--- /dev/null
+++ b/Plugins/Community Based Plugins/Microsoft Graph API plugins/Devices Onboarded into MDE/Readme.md
@@ -0,0 +1,36 @@
+# Plugin to retrieve Devices Onboarded into Microsoft Defender for Endpoint (MDE) Plugin
+
+## Overview
+This plugin enables users to retrieve a list of devices onboarded into **Microsoft Defender for Endpoint (MDE)** using the **Microsoft Graph API**. It provides valuable insights into device details, compliance status, risk levels, and more, facilitating security monitoring and incident response.
+
+## Features
+- Retrieves device details including **device name, OS, manufacturer, model, serial number, and MAC address**.
+- Identifies **compliance state** and **risk level** of onboarded devices.
+- Fetches devices based on **last seen date**
+- Supports filtering for devices based on **Azure AD join status, compliance status, and OS platform**.
+
+## API Endpoint
+**Base URL:** `https://graph.microsoft.com/v1.0`
+
+
+### Setup instructions
+#### Upload the Plugin manifest
+
+1. Obtain the manifest [MDEOnboardedDevicesPlugin.yaml](https://github.com/Azure/Copilot-For-Security/blob/main/Plugins/Community%20Based%20Plugins/Microsoft%20Graph%20API%20/Devices%20Onboarded%20into%20MDE/MDEOnboardedDevicesPlugin.yaml) and the OpenAPI Specification [MDEOnboardedDevices-OpenAPISpec.yaml](https://github.com/Azure/Copilot-For-Security/blob/main/Plugins/Community%20Based%20Plugins/Microsoft%20Graph%20API%20/Devices%20Onboarded%20into%20MDE/MDEOnboardedDevices-OpenAPISpec.yaml) files from this directory.
+2. Download the Spec file and move it to your preferred location, ensuring it is reachable by Security Copilot
+
+
+3. [Upload the custom plugin](https://learn.microsoft.com/en-us/security-copilot/manage-plugins?tabs=securitycopilotplugin#add-custom-plugins)
+
+## Example Natural Language Queries
+Use these sample prompts to retrieve relevant data via **Security Copilot**:
+- "Retrieve devices onboarded to MDE that have a compliance state of 'Non-compliant'"
+- "Get the list of non-compliant devices from devices onboarded to MDE"
+- "Retrieve a list of devices onboarded onto MDE that have a Risk Level of 'High'"
+- "Retrieve devices from MDE that registered less than 14 days ago from today"
+- "Retrieve a list of MDE endpoints that were last seen less than 1 day ago"
+- "Get devices from MDE that have the iOS operating system"
+
+
+---
+For more details, visit the **[Microsoft Graph API documentation](https://learn.microsoft.com/en-us/graph/)**.
diff --git a/Plugins/Community Based Plugins/Microsoft Security Experts/Microsoft Defender Experts Plugin/Dexplugin.yaml b/Plugins/Community Based Plugins/Microsoft Security Experts/Microsoft Defender Experts Plugin/Dexplugin.yaml
index 05b597a0..de1d5613 100644
--- a/Plugins/Community Based Plugins/Microsoft Security Experts/Microsoft Defender Experts Plugin/Dexplugin.yaml
+++ b/Plugins/Community Based Plugins/Microsoft Security Experts/Microsoft Defender Experts Plugin/Dexplugin.yaml
@@ -1,3 +1,4 @@
+---
Descriptor:
Name: MicrosoftDefenderExpertsPlugin
DisplayName: Microsoft Defender Experts Security Copilot Plugin
@@ -7,6 +8,7 @@ Descriptor:
SkillGroups:
- Format: KQL
Skills:
+
- Name: DEX-SuspiciousUseOfAzureHound
DisplayName: Suspicious Use of AzureHound
Description: Detects potential suspicious usage of AzureHound on devices.
@@ -21,7 +23,6 @@ SkillGroups:
| where TimeGenerated > ago({{days}}d)
| where FileName has "azurehound.exe"
| where ProcessCommandLine has "azurehound" and ProcessCommandLine has_any ("az-rm", "az-ad", "list", "Invoke-azurehound")
-
- Name: DEX-ReconnaissanceActivityUsingNetworkLogs
DisplayName: Reconnaissance Activity Using Network Logs
Description: Detects reconnaissance activity leveraging network logs and specific URLs.
@@ -42,7 +43,7 @@ SkillGroups:
- Name: DEX-RoadreconAndRoadtxActivity
DisplayName: ROADrecon and ROADtx Activity
- Description: Detects known filenames and command line activity associated with ROADrecon and ROADtx tools.
+ Description: Detects known filenames and command line activity associated with ROADrecon and roadtx tools.
Inputs:
- Name: days
Description: Look back x amount of days, for example 10, 20, 30.
@@ -269,8 +270,8 @@ SkillGroups:
Template: |-
DeviceFileEvents
| where TimeGenerated > ago({{days}}d)
- | where InitiatingProcessFileName =~ 'ping.exe' and InitiatingProcessCommandLine == 'ping.exe -t 127.0.0.1'
- and InitiatingProcessParentFileName in~('msra.exe', 'mobsync.exe') and FolderPath endswith ".eml"
+ | where InitiatingProcessFileName =~ "ping.exe" and InitiatingProcessCommandLine == "ping.exe -t 127.0.0.1"
+ and InitiatingProcessParentFileName in~ ("msra.exe", "mobsync.exe") and FolderPath endswith ".eml"
- Name: DEX-QakbotReconnaissanceActivities
DisplayName: Qakbot Reconnaissance Activities Detection
@@ -286,8 +287,8 @@ SkillGroups:
| where TimeGenerated > ago({{days}}d)
| where InitiatingProcessFileName == InitiatingProcessCommandLine
| where ProcessCommandLine has_any (
- "whoami /all","cmd /c set","arp -a","ipconfig /all","net view /all","nslookup -querytype=ALL -timeout=10",
- "net share","route print","netstat -nao","net localgroup")
+ "whoami /all", "cmd /c set", "arp -a", "ipconfig /all", "net view /all", "nslookup -querytype=ALL -timeout=10",
+ "net share", "route print", "netstat -nao", "net localgroup")
| summarize dcount(FileName), make_set(ProcessCommandLine) by DeviceId, bin(Timestamp, 1d), InitiatingProcessFileName, InitiatingProcessCommandLine
| where dcount_FileName >= 8
@@ -333,13 +334,13 @@ SkillGroups:
Template: |-
DeviceProcessEvents
| where TimeGenerated > ago({{days}}d)
- | where InitiatingProcessFileName =~ 'wmiprvse.exe'
- | where FileName =~ 'powershell.exe'
- and (ProcessCommandLine hasprefix '-e' or ProcessCommandLine contains 'frombase64')
- | where ProcessCommandLine matches regex '[A-Za-z0-9+/]{50,}[=]{0,2}'
- | where ProcessCommandLine !has 'Windows\\CCM\\'
+ | where InitiatingProcessFileName =~ "wmiprvse.exe"
+ | where FileName =~ "powershell.exe"
+ and (ProcessCommandLine hasprefix "-e" or ProcessCommandLine contains "frombase64")
+ | where ProcessCommandLine matches regex "[A-Za-z0-9+/]{50,}[=]{0,2}"
+ | where ProcessCommandLine !has "Windows\\CCM\\"
| project DeviceId, Timestamp, InitiatingProcessId, InitiatingProcessFileName, ProcessId, FileName, ProcessCommandLine
-
+
- Name: DEX-AutomatedEmailNotificationsAndSuspiciousSignInActivity
DisplayName: Automated Email Notifications and Suspicious Sign-In Activity Detection
Description: Correlates automated email notifications with suspicious sign-in activity to identify potential compromises.
@@ -439,6 +440,202 @@ SkillGroups:
| summarize dcount(UserSharedWith) by FileShared, AccountObjectId
| where dcount_UserSharedWith >= 20
+ - Name: DEX-TeamsActivityAfterSuspiciousRMM
+ DisplayName: Teams Activity After Suspicious RMM
+ Description: Detects Teams activity followed by suspicious Remote Monitoring and Management
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let interestingUsers = DeviceProcessEvents
+ | where Timestamp > ago(1h)
+ | where isnotempty(InitiatingProcessAccountObjectId)
+ | where FileName has_any ("quickassist.exe", "anydesk.exe", "teamviewer_service.exe") // Multiple RMM tools can be abused here
+ | project InitiatingProcessAccountUpn;
+ CloudAppEvents
+ | where Timestamp > ago(1d)
+ | where Application == "Microsoft Teams"
+ | where ActionType == "ChatCreated"
+ | where isempty(AccountObjectId)
+ | where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
+ | where RawEventData.CommunicationType == "OneOnOne"
+ | where RawEventData.ParticipantInfo.HasGuestUsers == false
+ | where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
+ | where AccountId has "@"
+ | extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
+ | where TargetUPN in (interestingUsers)
+ | extend VictimTenant = tostring(RawEventData.OrganizationId)
+ | extend AttackerTenant = RawEventData.Members[0].OrganizationId
+ | extend AttackerUPN = RawEventData.Members[0].UPN
+ | extend AttackerName = RawEventData.Members[0].DisplayName
+
+ - Name: DEX-TeamsPhishingviaUrlClickEvents
+ DisplayName: Teams Phishing via Url Click Events
+ Description: Correlate suspicious device alerts with URL click events in MS Teams.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let alertedDevices = AlertEvidence
+ | where Timestamp > ago(1h)
+ | where isnotempty(DeviceId)
+ | distinct DeviceId;
+ let interestedUsers = DeviceProcessEvents
+ | where Timestamp > ago(1h)
+ | where DeviceId in (alertedDevices)
+ | where isnotempty(InitiatingProcessAccountUpn)
+ | distinct InitiatingProcessAccountUpn;
+ UrlClickEvents
+ | where Timestamp > ago(1d)
+ | where ActionType == "ClickAllowed" or IsClickedThrough != "0"
+ | where Workload has "Teams"
+ | where AccountUpn in (interestedUsers)
+
+ - Name: DEX-TeamsAdversary-in-The-Middle(AiTM)
+ DisplayName: TeamsAdversary-in-The-Middle(AiTM)
+ Description: Correlate risky sign-in attempts with Teams phishing from external tenants to identify AiTM.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let usersWithRiskySignIn = AADSignInEventsBeta
+ | where Timestamp > ago(1h)
+ | where RiskLevelDuringSignIn == 100
+ | project AccountUpn;
+ CloudAppEvents
+ | where Timestamp > ago(1d)
+ | where Application == "Microsoft Teams"
+ | where ActionType == "ChatCreated"
+ | where isempty(AccountObjectId)
+ | where RawEventData.ParticipantInfo.HasForeignTenantUsers == true
+ | where RawEventData.CommunicationType == "OneOnOne"
+ | where RawEventData.ParticipantInfo.HasGuestUsers == false
+ | where RawEventData.ParticipantInfo.HasOtherGuestUsers == false
+ | where AccountId has "@"
+ | extend TargetUPN = tolower(tostring(RawEventData.Members[1].UPN))
+ | where TargetUPN in (usersWithRiskySignIn)
+ | extend TargetTenant = tostring(RawEventData.OrganizationId)
+ | extend AttackerTenant = RawEventData.Members[0].OrganizationId
+ | where TargetTenant != AttackerTenant
+ | extend AttackerUPN = RawEventData.Members[0].UPN
+ | extend AttackerName = RawEventData.Members[0].DisplayName
+ | project-reorder Timestamp, AttackerTenant, AttackerUPN, AttackerName, TargetUPN
+
+ - Name: DEX-SuspiciousFileDownloadsviaLOLBINs
+ DisplayName: Suspicious File Downloads via LOLBINs
+ Description: Detects Living-off-the-Land Binaries (LOLBINs) commonly used by adversaries to download additional payloads.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceNetworkEvents
+ | where TimeGenerated > ago({{days}}d)
+ | where InitiatingProcessFileName in~ ("curl.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe")
+ | where RemoteIPType == "Public"
+ | where RemoteUrl endswith ".exe" or RemoteUrl endswith ".dll" or RemoteUrl endswith ".zip"
+ | project Timestamp, DeviceId, InitiatingProcessFileName, RemoteIP, RemoteUrl
+ | extend AlertType = "Suspicious file download from unknown IP address"
+
+ - Name: DEX-CSVDEDownloadandADEnumeration
+ DisplayName: CSVDE Download and AD Enumeration
+ Description: Detects the download and execution of Csvde, a command-line tool that can be exploited by adversaries to extract sensitive data from AD DS or introduce malicious entries.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ // Detect curl downloading csvde.exe
+ let csvde_download = DeviceProcessEvents
+ | where InitiatingProcessFileName =~ "cmd.exe"
+ | where ProcessCommandLine has_all ("curl", "-o", "csvde.exe", "http:")
+ | project DeviceId, Timestamp, CurlCommandLine = ProcessCommandLine, CurlProcessId = ProcessId;
+ // Detect execution of csvde.exe with specific parameters
+ let csvde_execution = DeviceProcessEvents
+ | where FileName =~ "csvde.exe"
+ | where ProcessCommandLine has_all ("-r", "objectClass=Computer")
+ | where ProcessCommandLine has_all ("-l", "samAccountName", "description", "info", "operatingSystem")
+ | where ProcessCommandLine contains "-f"
+ | project DeviceId, Timestamp, CsvdeCommandLine = ProcessCommandLine, CsvdeProcessId = ProcessId;
+ // Join the two events and look for them occurring within 5 minutes
+ csvde_download
+ | join kind=inner (csvde_execution) on DeviceId
+ | where Timestamp between (Timestamp1 .. Timestamp1 + 5m)
+ | extend AlertType = "Potential Active Directory Enumeration", Details = strcat("curl.exe was used to download csvde.exe, which was then executed to enumerate AD computers.")
+
+ - Name: DEX-DataCompressionandExfiltration
+ DisplayName: Data Compression and Exfiltration
+ Description: Detects the use of 7-Zip for extracting files with a password and joins that process with network events to identify exfiltration of data.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ // Detect potential data compression and exfiltration
+ let compress_exfil = DeviceProcessEvents
+ | where FileName =~ "7z.exe"
+ | where ProcessCommandLine contains "x -p"
+ | project Timestamp, DeviceId, FileName, ProcessCommandLine, ProcessId
+ | join kind=inner (
+ DeviceNetworkEvents
+ | where InitiatingProcessId != 0
+ ) on $left.ProcessId == $right.InitiatingProcessId
+ | project Timestamp, DeviceId, FileName, ProcessCommandLine, RemoteIP, RemotePort
+ | extend AlertType = "Potential data compression and exfiltration";
+
+ - Name: DEX-PersistenceThroughStartupOperations
+ DisplayName: Persistence Through Startup Operations
+ Description: Detects adversary payloads used to create persistence via ASEP Registry Keys, Startup Folder, or Scheduled Tasks.
+ Inputs:
+ - Name: days
+ Description: Look back x amount of days, for example 10, 20, 30.
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ // Persistence through Startup operations
+ let regKeys = pack_array(@"CurrentVersion\Run",
+ @"CurrentVersion\RunOnce",
+ @"CurrentVersion\RunOnceEx",
+ @"Programs\Startup",
+ @"CurrentVersion\RunServicesOnce",
+ @"CurrentVersion\RunServices",
+ @"CurrentVersion\Policies\Explorer\Run",
+ @"Windows NT\CurrentVersion\Windows",
+ @"System\CurrentControlSet\Control\Session Manager");
+ let startUpOperations = DeviceFileEvents
+ | where FolderPath has @"Start Menu\Programs\Startup\"
+ | where ActionType in ("FileCreated", "FileModified", "FileRenamed");
+ // Persistence through Registry Tampering
+ let regOperations = DeviceRegistryEvents
+ | where hasAlertDevices
+ | where Timestamp between (startTime .. endTime)
+ | where DeviceId in (alertedDevices)
+ | where RegistryKey has_any (regKeys)
+ | where ActionType in ("SetValue", "CreateKey", "RenameKey");
+ // Persistence through Scheduled task creation
+ let scheduledOperations = DeviceProcessEvents
+ | where Timestamp between (startTime .. endTime)
+ | where DeviceId in (alertedDevices)
+ | where (InitiatingProcessCommandLine has "schtasks" and InitiatingProcessCommandLine has_any ("run", "create", "change"));
+ union startUpOperations, regOperations, scheduledOperations
+ | summarize arg_min(Timestamp, *) by DeviceId
+
- Name: DEX-PossibleAiTMPhishingAttemptAgainstEntraID
DisplayName: Possible AiTM Phishing Attempt Against Entra ID
Description: |
@@ -566,3 +763,157 @@ SkillGroups:
| extend UEBARiskScore = IPInvestigationPriority
| where UEBARiskScore > {{riskScoreCutoff}}
| sort by UEBARiskScore desc
+ - Name: DEX-BrowserRemoteDebugging
+ DisplayName: Browser Remote Debugging
+ Description: Identifies AutoIT scripts launching Chromium-based browsers (e.g., chrome.exe, msedge.exe, brave.exe) in remote debugging mode.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h", "4h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceProcessEvents
+ | where TimeGenerated > ago({{timeframe}})
+ | where InitiatingProcessVersionInfoInternalFileName == "AutoIt3.exe"
+ | where ProcessCommandLine has "--remote-debugging-port"
+ | project DeviceId, Timestamp, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
+
+ - Name: DEX-DPAPI-AutoIT
+ DisplayName: DPAPI Decryption via AutoIT
+ Description: Identifies DPAPI decryption activity originating from AutoIT scripts.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceEvents
+ | where Timestamp > ago({{timeframe}})
+ | where ActionType == "DpapiAccessed"
+ | where InitiatingProcessVersionInfoInternalFileName == "AutoIt3.exe"
+ | where (AdditionalFields has_any ("Google Chrome", "Microsoft Edge") and AdditionalFields has_any ("SPCryptUnprotect"))
+ | extend json = parse_json(AdditionalFields)
+ | extend dataDesp = tostring(json.DataDescription.PropertyValue)
+ | extend opType = tostring(json.OperationType.PropertyValue)
+ | where (dataDesp in~ ("Google Chrome", "Microsoft Edge") and opType =~ "SPCryptUnprotect")
+ | project Timestamp, ReportId, DeviceId, ActionType, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessCommandLine, AdditionalFields, dataDesp, opType
+
+ - Name: DEX-DPAPI-LOLBAS
+ DisplayName: DPAPI Decryption via LOLBAS Binaries
+ Description: Identifies DPAPI decryption activity originating from LOLBAS binaries such as RegAsm.exe and MSBuild.exe.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceEvents
+ | where Timestamp > ago({{timeframe}})
+ | where ActionType == "DpapiAccessed"
+ | where InitiatingProcessFileName has_any ("RegAsm.exe", "MSBuild.exe")
+ | where (AdditionalFields has_any ("Google Chrome", "Microsoft Edge") and AdditionalFields has_any ("SPCryptUnprotect"))
+ | extend json = parse_json(AdditionalFields)
+ | extend dataDesp = tostring(json.DataDescription.PropertyValue)
+ | extend opType = tostring(json.OperationType.PropertyValue)
+ | where (dataDesp in~ ("Google Chrome", "Microsoft Edge") and opType =~ "SPCryptUnprotect")
+ | project Timestamp, ReportId, DeviceId, ActionType, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessCommandLine, AdditionalFields, dataDesp, opType
+
+ - Name: DEX-SensitiveBrowserAccessAutoIT
+ DisplayName: Sensitive Browser File Access via AutoIT
+ Description: Identifies AutoIT scripts (renamed or otherwise) accessing sensitive browser files.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let browserDirs = pack_array(@"\Google\Chrome\User Data\", @"\Microsoft\Edge\User Data\", @"\Mozilla\Firefox\Profiles\");
+ let browserSensitiveFiles = pack_array("Web Data", "Login Data", "key4.db", "formhistory.sqlite", "cookies.sqlite", "logins.json", "places.sqlite", "cert9.db");
+ DeviceEvents
+ | where Timestamp > ago({{timeframe}})
+ | where AdditionalFields has_any ("FileOpenSource")
+ | where InitiatingProcessVersionInfoInternalFileName == "AutoIt3.exe"
+ | where (AdditionalFields has_any (browserDirs) or AdditionalFields has_any (browserSensitiveFiles))
+ | extend json = parse_json(AdditionalFields)
+ | extend File_Name = tostring(json.FileName.PropertyValue)
+ | where (File_Name has_any (browserDirs) and File_Name has_any (browserSensitiveFiles))
+ | project Timestamp, ReportId, DeviceId, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessCommandLine, File_Name
+
+ - Name: DEX-SensitiveBrowserAccessLOLBAS
+ DisplayName: Sensitive Browser File Access via LOLBAS
+ Description: Identifies LOLBAS binaries (e.g., RegAsm.exe, MSBuild.exe) accessing sensitive browser files.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let browserDirs = pack_array(@"\Google\Chrome\User Data\", @"\Microsoft\Edge\User Data\", @"\Mozilla\Firefox\Profiles\");
+ let browserSensitiveFiles = pack_array("Web Data", "Login Data", "key4.db", "formhistory.sqlite", "cookies.sqlite", "logins.json", "places.sqlite", "cert9.db");
+ DeviceEvents
+ | where Timestamp > ago({{timeframe}})
+ | where AdditionalFields has_any ("FileOpenSource")
+ | where InitiatingProcessFileName has_any ("RegAsm.exe", "MSBuild.exe")
+ | where (AdditionalFields has_any (browserDirs) or AdditionalFields has_any (browserSensitiveFiles))
+ | extend json = parse_json(AdditionalFields)
+ | extend File_Name = tostring(json.FileName.PropertyValue)
+ | where (File_Name has_any (browserDirs) and File_Name has_any (browserSensitiveFiles))
+ | project Timestamp, ReportId, DeviceId, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessCommandLine, File_Name
+
+ - Name: DEX-Node.jsInfostealerActivity
+ DisplayName: Node.js-based infostealer activity
+ Description: Detect malicious access to sensitive credentials using Windows DPAPI.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceEvents
+ | where Timestamp > ago({{timeframe}})
+ | where isnotempty(DeviceId)
+ | where ActionType == "DpapiAccessed"
+ | where InitiatingProcessParentFileName endswith "powershell.exe"
+ | where InitiatingProcessFileName =~ "node.exe"
+ | where InitiatingProcessCommandLine has_all ("-r", ".js") and InitiatingProcessCommandLine endswith ".jsc"
+ | where AdditionalFields has "SPCryptUnprotect"
+
+ - Name: DEX-SuspiciousInlineJavaScriptExecution
+ DisplayName: Suspicious inline JavaScript execution
+ Description: Identify suspicious inline JavaScript.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceProcessEvents
+ | where Timestamp > ago({{timeframe}})
+ | where isnotempty(DeviceId)
+ | where ProcessVersionInfoOriginalFileName == 'node.exe'
+ | where ProcessCommandLine has_all ('http', 'execSync', 'spawn', 'fs', 'path', 'zlib')
+
+ - Name: DEX-SuspiciousJSCFile
+ DisplayName: Suspicious JSC file
+ Description: Identify execution of suspicious JSC file.
+ Inputs:
+ - Name: timeframe
+ Description: Time frame to search (e.g., "1h", "2h").
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ DeviceProcessEvents
+ | where Timestamp > ago({{timeframe}})
+ | where isnotempty(DeviceId)
+ | where ProcessVersionInfoOriginalFileName == 'node.exe'
+ | where (ProcessCommandLine has_all (".jsc", ".js") and ProcessCommandLine matches regex @"\\\w*.jsc")
+
+...
diff --git a/Plugins/Community Based Plugins/Microsoft Security Exposure Management/Microsoft Security Exposure Management.yaml b/Plugins/Community Based Plugins/Microsoft Security Exposure Management/Microsoft Security Exposure Management.yaml
new file mode 100644
index 00000000..ce9764cb
--- /dev/null
+++ b/Plugins/Community Based Plugins/Microsoft Security Exposure Management/Microsoft Security Exposure Management.yaml
@@ -0,0 +1,99 @@
+Descriptor:
+ Name: Microsoft Exposure Management
+ DisplayName: Microsoft Exposure Management
+ Description: >
+ This KQL plugin integrates capabilities of Microsoft Security Exposure Management (MSEM) with Security Copilot to show exposed devices.
+ MSEM provides situational awareness, while Security Copilot (SCP) offers quick and consistent retrieval capabilities.
+ Together, MSEM and SCP empower SOC Engineers with a natural-language front door into exposure insights and attack paths.
+ This combination also enables the inclusion of MSEM content and reasoning over this content in Security Copilot prompts, prompt books, and automation scenarios that leverage Security Copilot.
+ The two skills of the plugin correspond to the following use cases -
+ 1) Obtain exposure of an asset hosted on a particular cloud platform by your organization.
+ 2) Obtain exposure of an asset belonging to a specific user.
+ In each of the above use cases, you can also specify the exposure level for which you want to extract the data.
+
+ SupportedAuthTypes:
+ - None
+
+#####################################################################################
+# SkillGroups can be a single type (KQL, GPT, API) or contain a mix
+#####################################################################################
+
+SkillGroups:
+ - Format: KQL
+
+ Skills:
+ - Name: GetExposedDevicesByCloudPlatform
+ DisplayName: Get exposed Devices by Cloud Platform and exposure level.
+ Description: For a specific cloud platform (aka "Azure" or "GCP" or "AWS") or a list of cloud platform of the device separated by commas, semi-colons, or using the word 'or', get a list of devices
+ based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
+ DescriptionForModel: For a specific cloud platform of the device (aka "Azure" or "GCP" or "AWS") or a list of cloud platform of the device separated by commas, get a list of devices based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas. The results will be returned as a response to the query containing multiple entries, the user needs to be shown the below details from the response about each device DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture.
+ VERY IMPORTANT - Never truncate the list of devices retrieved by launching the KQL query related to this skill. Also if the user wants to search on premises then the value for CloudPlatforms should be blank in the query
+
+ ExamplePrompts:
+ - Get all the devices exposed on Azure platform
+ - Get all the devices exposed on AWS platform
+ - Get all the devices exposed on GCP platform
+ - Get all the devices with exposure level High on Azure platform
+ - Get all the devices with exposure level Medium on Azure platform
+ - Get all the devices with exposure level Low on Azure platform
+ - Get all the devices with exposure level High on AWS platform
+ - Get all the devices with exposure level Medium on AWS platform
+ - Get all the devices with exposure level Low on AWS platform
+ - Get all the devices with exposure level High on GCP platform
+ - Get all the devices with exposure level Medium on GCP platform
+ - Get all the devices with exposure level Low on GCP platform
+
+ Inputs:
+ - Name: inputExposureLevel
+ Description: Provide the exposure level you want to consider - e.g. High, Medium, Low (only one level)
+ Required: true
+ - Name: inputCloudPlatforms
+ Description: Provide the cloud platform of the device you want to consider - e.g. Azure or GCP or AWS
+ Required: false
+
+ Settings:
+ Target: Defender
+ Template: |-
+ let userExposureLevel='{{inputExposureLevel}}';
+ let userCloudPlatform='{{inputCloudPlatforms}}';
+ DeviceInfo
+ | where ExposureLevel == userExposureLevel
+ | where
+ (CloudPlatforms != '' and (CloudPlatforms contains userCloudPlatform or isempty(userCloudPlatform)))
+ | project DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture, TimeGenerated
+
+ - Name: GetExposedDevicesByUser
+ DisplayName: Get exposed devices by UPN and optionally exposure level
+ Description: For a specific user UPN (aka "user" or "UPN") or a list of users separated by commas, get a list of devices
+ based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
+ DescriptionForModel: For a specific user UPN (aka "user" or "UPN") or a list of users separated by commas, get a list of devices
+ based on the exposure level specified by the user (aka "Low" or "Medium" or "High") or a list of exposures separated by commas.
+ The results will be returned as a response to the query containing multiple entries, the user needs to be shown the below details from the response about each device UPN, DeviceName, DeviceId, ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture.
+ VERY IMPORTANT - Never truncate the list of devices retrieved by launching the KQL query related to this skill. Also if the user wants to search on premises then the value for CloudPlatforms should be blank in the query.
+
+ ExamplePrompts:
+ - Get all the devices with exposure level High belonging to user john.doe@contoso.com
+ - Get all the devices with exposure level Medium belonging to user john.doe@contoso.com
+ - Get all the devices with exposure level Low belonging to user john.doe@contoso.com
+
+ Inputs:
+ - Name: inputExposureLevel
+ Description: Provide the exposure level you want to consider - e.g. High, Medium, Low
+ Required: false
+ - Name: inputUPN
+ Description: Provide the user primary name (UPN)
+ Required: true
+ Settings:
+ Target: Defender
+ Template: |-
+ let userExposureLevel='{{inputExposureLevel}}';
+ let userUPN='{{inputUPN}}';
+ IntuneDevices
+ | where UPN == userUPN
+ | project DeviceName = tolower(DeviceName)
+ | join kind=inner (
+ DeviceInfo
+ | where ExposureLevel == userExposureLevel or isempty(userExposureLevel)
+ | project DeviceName = tolower(DeviceName), DeviceId,ExposureLevel, CloudPlatforms, OSPlatform, OSArchitecture, TimeGenerated
+ ) on DeviceName
+
diff --git a/Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/High Blast Radius User investigation/HighBlastRaidusUserInvestigation.yaml b/Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/High Blast Radius User investigation/HighBlastRaidusUserInvestigation.yaml
index 85dbb803..80955111 100644
--- a/Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/High Blast Radius User investigation/HighBlastRaidusUserInvestigation.yaml
+++ b/Plugins/Community Based Plugins/Microsoft Sentinel Custom Plugin Scenarios/High Blast Radius User investigation/HighBlastRaidusUserInvestigation.yaml
@@ -45,8 +45,7 @@ SkillGroups:
TimeGenerated,
AccountUPN,
AccountDisplayName,
- AccountCreationTime,
- RiskState,
+ AccountCreationTime,
BlastRadius,
GroupMembership,
AssignedRoles,
diff --git a/Technical Workshops/Custom Plugin Calling Webservice/FlaskWebsite/requirements.txt b/Technical Workshops/Custom Plugin Calling Webservice/FlaskWebsite/requirements.txt
index 100cabad..225c854c 100644
--- a/Technical Workshops/Custom Plugin Calling Webservice/FlaskWebsite/requirements.txt
+++ b/Technical Workshops/Custom Plugin Calling Webservice/FlaskWebsite/requirements.txt
@@ -1 +1 @@
-Flask==3.0.2
\ No newline at end of file
+Flask==3.1.3
\ No newline at end of file
|
|
|
|
-- Choose Client Certificate Auth or Oauth (using user account that can submit prompts) to create connection with Microsoft Copilot for Security logic app connector.
+- Choose Client Certificate Auth or Oauth (using user account that can submit prompts) to create connection with Microsoft Security Copilot logic app connector.
-- Automate Sentinel incident investigation by adding the Logic App to Microsoft Sentinel automation rule.
-- Alternatively, this logic app can be called on-demand by right-clicking on a Sentinel incident, choose **Run Playbook** option.
+- Important: the account selected for the authentication to Security Copilot must have the Contributor role on Security Copilot and reader privileges on Defender, Sentinel, Entra and Intune.
+- Similarly, authenticate the API connection to Exchange Online (the correct setup of connection is needed even if the Logic App is configured to not send emails)
+- Assign the role of 'Microsoft Sentinel Responder' to the Managed Identity of the Logic App within the Resource Group that contains the Sentinel's Log Analytics workspace.
+- Set the values for the Logic App parameters
+
+- Automate Sentinel incident investigation by adding the Logic App to Microsoft Sentinel automation rule. Alternatively, this logic app can be called on-demand by right-clicking on a Sentinel incident, choose **Run Playbook** option.
-## Microsoft Copilot for Security skills
+## Microsoft Security Copilot skills
- Following built-in skills are being used to perform investigation on a given incident entity type
-| Incident entity | Copilot for Security skill |
+| Incident entity | Security Copilot skill |
| --------------- | -------------------------- |
| Process name / commandline | ProcessAnalyzer |
| Account name | GetEntraUserDetails |
+| Account names | GetEntraRiskyUsers |
| Device name | GetIntuneDevices |
| IP address | AbuseIPDB |
+| Indicator of Compromise (IoC) | GetReputationsForIndicators |
## Incident Investigation Template
- Automated incident investigation summary is structured in following order. Modify the prompt to re-order or change the investigation template.
- - Incident overview:
- - Incident description:
- - Analysis on incident entities:
- - Possible mitigation steps:
- - Conclusion
+ - Incident Overview,
+ - Incident Description,
+ - IP Addresses Analysis,
+ - Account Analysis,
+ - Users Risk Analysis,
+ - Devices Analysis,
+ - Processes Analysis,
+ - Indicators Analysis from MDTI,
+ - Possible mitigation steps and Conclusion
diff --git a/Logic Apps/ciso-reporting/ciso-incidents-summary-man.yaml b/Logic Apps/ciso-reporting/ciso-incidents-summary-man.yaml
index 6f26fafe..bdab9c01 100644
--- a/Logic Apps/ciso-reporting/ciso-incidents-summary-man.yaml
+++ b/Logic Apps/ciso-reporting/ciso-incidents-summary-man.yaml
@@ -24,7 +24,7 @@ SkillGroups:
DisplayName: CISO - Incidents Status Summary
Description: Get a summary of the incidents status in Defender
DescriptionForModel : Get a summary of the incidents status in Defender.
- If severities are specified in the prompt (e.g. High and Medium), concatenate them as a comma separated list of double-quoted strings (like "High","Medium").
+ If severities are specified in the prompt (e.g. High and Medium), concatenate them as a comma separated list of double-quoted strings with the first letter in uppercase (like "High","Medium").
If start date and end date are not specified, consider the last 7 days.
If the top number of results is not specified, consider 5 incidents titles.
If csv_of_severities is not specified, consider only "High".
@@ -81,7 +81,7 @@ SkillGroups:
DisplayName: CISO - True Positive Incidents Tactics and Techniques Analysis
Description: Get a summary of the tactics and techniques used in the incidents that were classified as true positives
DescriptionForModel : Get a summary of the tactics and techniques used in the incidents that were classified as true positives
- If severities are specified in the prompt (e.g. High and Medium), concatenate them as a comma separated list of double-quoted strings (like "High","Medium").
+ If severities are specified in the prompt (e.g. High and Medium), concatenate them as a comma separated list of double-quoted strings with the first letter in uppercase (like "High","Medium").
If start date and end date are not specified, consider the last 7 days.
If severities is not specified, consider only "High".
Inputs:
diff --git a/Logic Apps/ciso-reporting/ciso-posture-summary-man.yaml b/Logic Apps/ciso-reporting/ciso-posture-summary-man.yaml
index c9a8ff19..2a78fbdf 100644
--- a/Logic Apps/ciso-reporting/ciso-posture-summary-man.yaml
+++ b/Logic Apps/ciso-reporting/ciso-posture-summary-man.yaml
@@ -12,6 +12,7 @@ SkillGroups:
DisplayName: CISO - Recommendations by Severity
Description: Get the list of the active recommendations by Severity (work in progress)
DescriptionForModel : Get the list of the active recommendations by Severity
+ If severities are specified in the prompt (e.g. High and Medium), concatenate them as a comma separated list of double-quoted strings with the first letter in uppercase (like "High","Medium").
Inputs:
- Name: days_back
Description: The number of days to be considered in the past, starting from today
diff --git a/Logic Apps/ciso-reporting/images/yt.png b/Logic Apps/ciso-reporting/images/yt.png
new file mode 100644
index 00000000..0bf5879d
Binary files /dev/null and b/Logic Apps/ciso-reporting/images/yt.png differ
diff --git a/Logic Apps/ciso-reporting/install-guide.md b/Logic Apps/ciso-reporting/install-guide.md
new file mode 100644
index 00000000..4faf3266
--- /dev/null
+++ b/Logic Apps/ciso-reporting/install-guide.md
@@ -0,0 +1,190 @@
+
+# Prerequisites
+
+> 
Mini-video showing the first execution of the Incidents Analysis automation (4m): [CISO Reporting with Security Copilot - Prototype setup - **#6** Run Incidents Analysis]
+
+ On the Security Copilot portal, accessed with credentials with the Security Copilot Automation Account:
+ - [**STEP 6.1**] Ensure that all the custom plugins just installed are enabled.
+ Optionally, test the [ciso-get-users-status.json](https://github.com/Azure/Security-Copilot/blob/main/Logic%20Apps/ciso-reporting/ciso-get-users-status.json) Logic App
+ by invoking the "CISO Get Users Staus" skill in the [ciso-incidents-summary-man](https://github.com/Azure/Security-Copilot/blob/main/Logic%20Apps/ciso-reporting/ciso-incidents-summary-man.yaml).
+ For this purpose, use the following inputs:
+ - api-version = 2016-10-01
+ - sp = /triggers/AnalyzeUPNsCall/run
+ - sv = 1.0
+ - users_upn = one or more comma separated UPNs of users in your tenant
+
+
+ On the Security Copilot portal, accessed with credentials with the Owner role:
+ - [**STEP 6.2**] Increment temporarily the number of SCUs to ensure the first "test" executions can be completed successfully.
+
+ On the Azure portal, accessed with credentials with an administrative role:
+ - [**STEP 6.3**] Enable the "**CISO Incidents Analysis**" automation and wait its first automatic execution
+
+## [**STEP 7**] Enable the "**CISO Posture Analysis**" automation and wait for the completion of its first automatic execution
+
+ >