For this post I'm going to start with the query on the Sentinel Home Page that shows Potential MaliciousIP events. Here is the example from my portal:
Note: There are indicators for In...
Updated Nov 03, 2021
Version 4.0
Blog Post
Hello Panther_tux the workbook uses specific Tables, like Wiredata, so if your newly ingested data isn't in Wiredata or one of the other 5 your data wont show up, without making edits to the Workbook.
If you have Syslog, your data is probably in the Syslog table, if its in CEF, then the workbook does look for that as I include the CommonSecurityLog table (which holds CEF).
If you wish to map the data the data needs to have the Country or Longitude/Latitude information as well or a way to correlate to a table that does.
the columns where the Country, Longitude and Latitude for your data source maybe named differently, this works for CEF, but you would have to amend for your data / columns (assuming it has country / long and lat)?
CommonSecurityLog
| extend TrafficDirection = iff(CommunicationDirection != "Outbound","InboundOrUnknown", "Outbound"), Country=MaliciousIPCountry, Latitude=MaliciousIPLatitude, Longitude=MaliciousIPLongitude, Confidence=ThreatDescription, Description=ThreatDescription
| where isnotempty(Country) or isnotempty(Longitude)
| summarize count() by Type, TrafficDirection, Longitude, Latitude, Country