Microsoft Defender ATP Telemetry: Workbook Visualizations



In my first post, Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context, in this series I explained how clients can visualize MITRE Tactic and Technique charts from Advanced Hunting queries in Defender ATP. In the second post, Microsoft Defender ATP Telemetry: Azure Log Analytics Workspace, I went over how these logs can be ingested into a newly created workspace with a Logic App. In this final post I will go over creating a simple Log Analytics workbook to visualize the data in a way that I prefer.


Under the General section choose “Workbooks” and then select “Empty” on the right-hand side under quick start.


Micro Defender Pt3 Img 1

Figure 1: Newly created Log Analytics workspace


The first thing I am going to do is add some text to describe the Workbook.


Micro Defender Pt3 Img 2


This text can be anything you choose. This is just a description for the analyst.


Micro Defender Pt3 Img 3

Figure 2: Workbook -Text Settings


I chose to save the Workbook and edit the title at this point before moving on.


Micro Defender Pt3 Img 4

Figure 3: Workbook -Text Settings


Next I decided to add URL links to each of the MITRE ATT&CK Tactic sections.


Micro Defender Pt3 Img 5


Add Links


Micro Defender Pt3 Img 6

Figure 3: Workbook – Adding Links


The link style was changed to Navigation.


Micro Defender Pt3 Img 7

Figure 4: Workbook –> Adding Links -> Style -> Navigation


This produces a clean links section.


Micro Defender Pt3 Img 8

Figure 4: Tactic category Link Navigation


Next I wanted to add two pie charts in the same group to show Tactics seen this week and Tactics seen the previous week. I accomplished this by adding a group to start.


Add a group


Micro Defender Pt3 Img 9


Rename the group


Micro Defender Pt3 Img 10

Figure 5: Workbook –> Group Creation


We are going to add a query using Add parameters


Micro Defender Pt3 Img 11

Figure 6: Creation of a query with in the newly created Group


The first query is going to search the DefenderTTPs_CL Logs (or whatever your custom log name is), with an event timestamp from 1 minute ago to 7 days ago, and summarize the results. The results were rendered in a pie chart as seen under the visualization drop down. This is seen in the image below.


Note: I included a where statement of when the TimeGenerated was not equal to empty. I wanted to focus on the Timestamp_t field. I am sure there are other ways to do this during ingestion or with parameters, but this serves as a workaround.


//TimeGenerated is set to not blank because in this example we are using the Timestamp_t.
| where TimeGenerated != ""
| where Timestamp_t between (ago(7d) .. ago(1m))
| summarize count() by Category


Micro Defender Pt3 Img 12

Figure 7: Query for Tactics with timestamps over the last seven days


Under Advanced Settings I chose to have the data be CSV exportable.


Micro Defender Pt3 Img 13

Figure 8: Query -> Advanced Settings Excel Export


The Style of the chart needs to be changed so that an additional pie chart can be placed next to it in the workbook.


Micro Defender Pt3 Img 14

Figure 9: Query -> Style Settings


The results are shown in the pie chart below. Note: If “Other” is listed, is not representative of an ATT&CK category, but a consolidation of lesser values.


Micro Defender Pt3 Img 15

Figure 10: Tactics Seen This Week Pie Chart


Once again we need to add a query to the group.


Micro Defender Pt3 Img 16


This query is similar to the one above only that the Timestamp of results is between the last 14-7 days as seen below. Also note that Time Range is set to set in query.


//TimeGenerated is set to not blank because in this example we are using the Timestamp_t.
| where TimeGenerated !=""
| where Timestamp_t between (ago(14d) .. ago(7d))
| summarize count() by Category


Micro Defender Pt3 Img 17

Figure 11: Query for Tactics with timestamps between the last fourteen to seven days


Micro Defender Pt3 Img 18

Figure 12: Creation of a query with in the newly created Group


Micro Defender Pt3 Img 19

Figure 13: Current workbook


Next we are going to create a bar chart of techniques used in the environment over a period of our choosing leveraging a drop-down box to select the time. First thing to do is to add a new parament.


Micro Defender Pt3 Img 20


The new parameter will be called TimeRange and will be a Time range picker. Check that it is required. I have optionally unchecked all time under 24 hours.


Micro Defender Pt3 Img 21

Figure 14: Parameter Creation


Once saved you should see something like this.


Micro Defender Pt3 Img 22


Next we need to add a new query. There is an added where statement to make the Timestamp value of the alert equal to the time range value. Otherwise we would be getting TimeGenerated back in the results and not the actual time of the alert. Note the green arrow. In order to test this query a time range needs to be selected.


| where AttackTechniques_s != ""
| where Timestamp_t {TimeRange}
| mvexpand todynamic(AttackTechniques_s)
| summarize count() by tostring(AttackTechniques_s) | order by AttackTechniques_s desc


Micro Defender Pt3 Img 23

Figure 14: Bar chart creation of techniques based on Time Range parameter


When completed, the workbook should look like the one below.


Micro Defender Pt3 Img 24

Figure 15: Completed workbook


Now we have a workbook with links to MITRE ATT&CK categories, category charts for the current and previous weeks regarding ATT&CK and a selectable time range that shows the alerts with techniques used. This is just one example of how Defender ATP log data can be visualized. Azure workbooks allow for a lot of customization to visualize data. Keep in mind we’ve only scratched the surface on this example.


Read more from this 3 part series.
Microsoft Defender ATP Telemetry: Viewing MITRE ATT&CK Context (Part 1)
Microsoft Defender ATP Telemetry: Azure Log Analytics Workspace (Part 2)

Dan Kiraly
Senior Research Scientist | Optiv
Dan Kiraly is senior research scientist on Optiv’s R&D team. In this role he's responsible for use case development and the vetting of security products for Optiv.