@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
json 117 lines 3.05 KB
Raw
1 {
2 "id": "O365_THREAT_INTELLIGENCE",
3 "title": "Office 365 - Threat Intelligence",
4 "description": "Microsoft Defender for Office 365 threat intelligence: phish and malware detections, delivery actions, detection methods, mail directionality, sender analysis, and source country tracking.",
5 "panels": [
6 {
7 "id": "alerts",
8 "title": "Alerts (rule level ≥ 12)",
9 "type": "stat",
10 "w": 3,
11 "h": 100,
12 "lucene": "data_office365_Workload:ThreatIntelligence AND rule_level:>=12"
13 },
14 {
15 "id": "total_events",
16 "title": "Total Events",
17 "type": "stat",
18 "w": 3,
19 "h": 100,
20 "lucene": "data_office365_Workload:ThreatIntelligence"
21 },
22 {
23 "id": "max_severity",
24 "title": "Max Rule Severity",
25 "type": "stat",
26 "w": 3,
27 "h": 100,
28 "lucene": "data_office365_Workload:ThreatIntelligence"
29 },
30 {
31 "id": "unique_senders",
32 "title": "Unique Senders",
33 "type": "stat",
34 "w": 3,
35 "h": 100,
36 "lucene": "data_office365_Workload:ThreatIntelligence"
37 },
38 {
39 "id": "events_over_time",
40 "title": "Threat Events Over Time",
41 "type": "histogram",
42 "w": 12,
43 "h": 200,
44 "lucene": "data_office365_Workload:ThreatIntelligence"
45 },
46 {
47 "id": "by_detection_method",
48 "title": "By Detection Method",
49 "type": "pie",
50 "w": 6,
51 "h": 300,
52 "lucene": "data_office365_Workload:ThreatIntelligence",
53 "field": "data_office365_DetectionMethod",
54 "size": 10
55 },
56 {
57 "id": "by_delivery_action",
58 "title": "By Delivery Action",
59 "type": "pie",
60 "w": 6,
61 "h": 300,
62 "lucene": "data_office365_Workload:ThreatIntelligence",
63 "field": "data_office365_DeliveryAction",
64 "size": 10
65 },
66 {
67 "id": "by_directionality",
68 "title": "By Directionality",
69 "type": "bar_h",
70 "w": 6,
71 "h": 320,
72 "lucene": "data_office365_Workload:ThreatIntelligence",
73 "field": "data_office365_Directionality",
74 "size": 10
75 },
76 {
77 "id": "top_senders",
78 "title": "Top Senders (P1Sender)",
79 "type": "bar_h",
80 "w": 6,
81 "h": 320,
82 "lucene": "data_office365_Workload:ThreatIntelligence",
83 "field": "data_office365_P1Sender",
84 "size": 15
85 },
86 {
87 "id": "top_operations",
88 "title": "Top Operations",
89 "type": "bar_h",
90 "w": 6,
91 "h": 320,
92 "lucene": "data_office365_Workload:ThreatIntelligence",
93 "field": "data_office365_Operation",
94 "size": 15
95 },
96 {
97 "id": "by_country",
98 "title": "Events by Sender Country",
99 "type": "bar_h",
100 "w": 6,
101 "h": 320,
102 "lucene": "data_office365_Workload:ThreatIntelligence",
103 "field": "data_office365_SenderIp_country_code",
104 "size": 15
105 },
106 {
107 "id": "top_rules",
108 "title": "Top Rules Triggered",
109 "type": "bar_h",
110 "w": 6,
111 "h": 320,
112 "lucene": "data_office365_Workload:ThreatIntelligence AND rule_level:>=12",
113 "field": "rule_description",
114 "size": 10
115 }
116 ]
117 }