@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
json 195 lines 5.52 KB
Raw
1 {
2 "id": "O365_ACTIVE_DIRECTORY",
3 "title": "Office 365 - Active Directory",
4 "description": "Azure Active Directory audit and sign-in activity: alerts, device events, user additions, external logins, non-MFA logins, failed authentications, auth by country, operations breakdown, and user agent analysis.",
5 "panels": [
6 {
7 "id": "alerts",
8 "title": "Alerts (rule level ≥ 12)",
9 "type": "stat",
10 "w": 4,
11 "h": 100,
12 "lucene": "data_office365_Workload:AzureActiveDirectory AND rule_level:>=12"
13 },
14 {
15 "id": "total_events",
16 "title": "Events (Total)",
17 "type": "stat",
18 "w": 4,
19 "h": 100,
20 "lucene": "data_office365_Workload:AzureActiveDirectory"
21 },
22 {
23 "id": "max_severity",
24 "title": "Max Severity (0 - 15)",
25 "type": "stat",
26 "w": 4,
27 "h": 100,
28 "lucene": "data_office365_Workload:AzureActiveDirectory"
29 },
30
31 {
32 "id": "operations_over_time",
33 "title": "Top 10 Operations - Histogram",
34 "type": "histogram",
35 "w": 12,
36 "h": 250,
37 "lucene": "data_office365_Workload:AzureActiveDirectory"
38 },
39
40 {
41 "id": "total_auths",
42 "title": "Azure AD - Total Auths",
43 "type": "stat",
44 "w": 3,
45 "h": 100,
46 "lucene": "data_office365_Operation:UserLoggedIn"
47 },
48 {
49 "id": "failed_auths",
50 "title": "Azure AD - Failed Auths",
51 "type": "stat",
52 "w": 3,
53 "h": 100,
54 "lucene": "data_office365_Operation:UserLoginFailed"
55 },
56 {
57 "id": "external_logins",
58 "title": "External Users Login",
59 "type": "stat",
60 "w": 3,
61 "h": 100,
62 "lucene": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com)"
63 },
64 {
65 "id": "non_mfa_logins",
66 "title": "Non-MFA Logins",
67 "type": "stat",
68 "w": 3,
69 "h": 100,
70 "lucene": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1"
71 },
72
73 {
74 "id": "device_events",
75 "title": "Device Events (Total)",
76 "type": "stat",
77 "w": 6,
78 "h": 100,
79 "lucene": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\""
80 },
81 {
82 "id": "users_added",
83 "title": "Users Added Events (Total)",
84 "type": "stat",
85 "w": 6,
86 "h": 100,
87 "lucene": "data_office365_Operation:\"Add user.\""
88 },
89
90 {
91 "id": "by_operation",
92 "title": "Events by Operation (Top 10)",
93 "type": "pie",
94 "w": 6,
95 "h": 300,
96 "lucene": "data_office365_Workload:AzureActiveDirectory",
97 "field": "data_office365_Operation",
98 "size": 10
99 },
100 {
101 "id": "users_added_by_result",
102 "title": "Users Added Events (Results)",
103 "type": "pie",
104 "w": 6,
105 "h": 300,
106 "lucene": "data_office365_Operation:\"Add user.\"",
107 "field": "data_office365_ResultStatus",
108 "size": 10
109 },
110
111 {
112 "id": "top_operations",
113 "title": "Events by Operation",
114 "type": "bar_h",
115 "w": 6,
116 "h": 320,
117 "lucene": "data_office365_Workload:AzureActiveDirectory",
118 "field": "data_office365_Operation",
119 "size": 15
120 },
121 {
122 "id": "auth_by_country",
123 "title": "All Auth Events by Country",
124 "type": "bar_h",
125 "w": 6,
126 "h": 320,
127 "lucene": "data_office365_Workload:AzureActiveDirectory",
128 "field": "data_office365_ActorIpAddress_country_code",
129 "size": 15
130 },
131
132 {
133 "id": "failed_auths_by_error",
134 "title": "Failed Auths by Error (Top 15)",
135 "type": "bar_h",
136 "w": 6,
137 "h": 320,
138 "lucene": "data_office365_Operation:UserLoginFailed",
139 "field": "data_office365_LogonError",
140 "size": 15
141 },
142 {
143 "id": "failed_auths_by_account",
144 "title": "Failed Auths by Account",
145 "type": "bar_h",
146 "w": 6,
147 "h": 320,
148 "lucene": "data_office365_Operation:UserLoginFailed",
149 "field": "data_office365_UserId",
150 "size": 15
151 },
152
153 {
154 "id": "external_login_users",
155 "title": "External Users Login (Accounts)",
156 "type": "bar_h",
157 "w": 6,
158 "h": 320,
159 "lucene": "data_office365_Operation:UserLoggedIn AND (data_office365_UserId:*#EXT# OR data_office365_UserId:*gmail.com)",
160 "field": "data_office365_UserId",
161 "size": 15
162 },
163 {
164 "id": "non_mfa_users",
165 "title": "Non-MFA Login Accounts",
166 "type": "bar_h",
167 "w": 6,
168 "h": 320,
169 "lucene": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success AND data_office365_ExtendedProperties_UserAuthenticationMethod:1",
170 "field": "data_office365_UserId",
171 "size": 15
172 },
173
174 {
175 "id": "device_events_by_operation",
176 "title": "Device Events by Operation",
177 "type": "bar_h",
178 "w": 6,
179 "h": 320,
180 "lucene": "data_office365_Operation:\"Add device.\" OR data_office365_Operation:\"Add registered owner to device.\" OR data_office365_Operation:\"Add registered users to device.\"",
181 "field": "data_office365_Operation",
182 "size": 10
183 },
184 {
185 "id": "successful_auths_by_user_agent",
186 "title": "Successful Auths by User Agent (Top 15)",
187 "type": "bar_h",
188 "w": 6,
189 "h": 320,
190 "lucene": "data_office365_Operation:UserLoggedIn AND data_office365_ResultStatus:Success",
191 "field": "data_office365_ExtendedProperties_UserAgent",
192 "size": 15
193 }
194 ]
195 }