@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
json 137 lines 3.53 KB
Raw
1 {
2 "id": "O365_SUMMARY",
3 "title": "Office 365 - Summary",
4 "description": "High-level overview of all Office 365 activity: alert counts, workload distribution, operations breakdown, Azure AD authentication events (successes and failures), failed auth accounts, and a full event log with MITRE ATT&CK context.",
5 "panels": [
6 {
7 "id": "alerts",
8 "title": "Alerts (rule level ≥ 12)",
9 "type": "stat",
10 "w": 3,
11 "h": 100,
12 "lucene": "data_office365_Workload:* AND rule_level:>=12"
13 },
14 {
15 "id": "total_events",
16 "title": "Total Events",
17 "type": "stat",
18 "w": 3,
19 "h": 100,
20 "lucene": "data_office365_Workload:*"
21 },
22 {
23 "id": "azure_ad_total_auths",
24 "title": "Azure AD - Total Auths",
25 "type": "stat",
26 "w": 3,
27 "h": 100,
28 "lucene": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoggedIn"
29 },
30 {
31 "id": "azure_ad_failed_auths",
32 "title": "Azure AD - Failed Auths",
33 "type": "stat",
34 "w": 3,
35 "h": 100,
36 "lucene": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed"
37 },
38 {
39 "id": "events_over_time",
40 "title": "Events Over Time by Workload",
41 "type": "histogram",
42 "w": 12,
43 "h": 200,
44 "lucene": "data_office365_Workload:*"
45 },
46 {
47 "id": "by_workload",
48 "title": "Events by Workload",
49 "type": "pie",
50 "w": 4,
51 "h": 300,
52 "lucene": "data_office365_Workload:*",
53 "field": "data_office365_Workload",
54 "size": 10
55 },
56 {
57 "id": "by_operation",
58 "title": "Events by Operation",
59 "type": "pie",
60 "w": 4,
61 "h": 300,
62 "lucene": "data_office365_Workload:*",
63 "field": "data_office365_Operation",
64 "size": 10
65 },
66 {
67 "id": "by_rule_level",
68 "title": "By Rule Severity Level",
69 "type": "pie",
70 "w": 4,
71 "h": 300,
72 "lucene": "data_office365_Workload:*",
73 "field": "rule_level",
74 "size": 10
75 },
76 {
77 "id": "top_operations",
78 "title": "Top Operations",
79 "type": "bar_h",
80 "w": 6,
81 "h": 320,
82 "lucene": "data_office365_Workload:*",
83 "field": "data_office365_Operation",
84 "size": 15
85 },
86 {
87 "id": "top_workloads",
88 "title": "Top Workloads",
89 "type": "bar_h",
90 "w": 6,
91 "h": 320,
92 "lucene": "data_office365_Workload:*",
93 "field": "data_office365_Workload",
94 "size": 10
95 },
96 {
97 "id": "failed_auth_by_account",
98 "title": "Failed Auths by Account",
99 "type": "bar_h",
100 "w": 6,
101 "h": 320,
102 "lucene": "data_office365_Workload:AzureActiveDirectory AND data_office365_Operation:UserLoginFailed",
103 "field": "data_office365_UserId",
104 "size": 15
105 },
106 {
107 "id": "auth_by_country",
108 "title": "Azure AD Auth Events by Country",
109 "type": "bar_h",
110 "w": 6,
111 "h": 320,
112 "lucene": "data_office365_Workload:AzureActiveDirectory",
113 "field": "data_office365_ActorIpAddress_country_code",
114 "size": 15
115 },
116 {
117 "id": "top_users",
118 "title": "Top Users",
119 "type": "bar_h",
120 "w": 6,
121 "h": 320,
122 "lucene": "data_office365_Workload:*",
123 "field": "data_office365_UserId",
124 "size": 10
125 },
126 {
127 "id": "top_rules",
128 "title": "Top Rules Triggered",
129 "type": "bar_h",
130 "w": 6,
131 "h": 320,
132 "lucene": "data_office365_Workload:* AND rule_level:>=12",
133 "field": "rule_description",
134 "size": 10
135 }
136 ]
137 }