![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/HoneyForgeLogo.svg\")
",
+ "Description": "The [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.",
+ "Workbooks": [
+ "Solutions/HoneyForge/Workbooks/HoneyForge.json"
+ ],
+ "Data Connectors": [
+ "Solutions/HoneyForge/Data Connectors/HoneyForge.json"
+ ],
+ "Analytic Rules": [
+ "Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml"
+ ],
+ "Hunting Queries": [
+ "Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml",
+ "Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml",
+ "Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml",
+ "Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml",
+ "Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml"
+ ],
+ "BasePath": "C:\\GitHub\\Azure-Sentinel\\",
+ "Version": "3.0.0",
+ "Metadata": "SolutionMetadata.json",
+ "TemplateSpec": true,
+ "Is1PConnector": false
+}
diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml
new file mode 100644
index 00000000000..0106f4ba7a9
--- /dev/null
+++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml
@@ -0,0 +1,53 @@
+id: 7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c
+name: HoneyForge - Sensor Fleet Coverage and Health
+description: |
+ Provides a per-sensor event summary for the past 30 days, giving visibility
+ into which sensors are active, which are quiet, and which may be offline or
+ misconfigured (no events in the last 10 minutes is the offline threshold).
+
+ Use this query during routine operations to confirm full fleet coverage and
+ identify any gaps in your deception layer before an attacker does.
+requiredDataConnectors:
+ - connectorId: HoneyForge
+ dataTypes:
+ - CommonSecurityLog
+tactics:
+ - Reconnaissance
+relevantTechniques:
+ - T1595
+ - T1590
+query: |
+ let lookback = 30d;
+ let offlineThreshold = 10m;
+ CommonSecurityLog
+ | where TimeGenerated >= ago(lookback)
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ SensorID = tostring(DeviceCustomString1),
+ CustomerID = tostring(DeviceCustomString2),
+ SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))
+ | summarize
+ TotalEvents = count(),
+ UniqueSources = dcount(SourceIP),
+ FirstEvent = min(TimeGenerated),
+ LastEvent = max(TimeGenerated),
+ Protocols = make_set(tostring(Protocol), 10)
+ by SensorID, SensorName, CustomerID
+ | extend
+ MinutesSinceLast = datetime_diff('minute', now(), LastEvent),
+ SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, "Online", "Offline / No Recent Events"),
+ ProtocolStr = strcat_array(Protocols, ", ")
+ | sort by SensorStatus asc, LastEvent desc
+ | project
+ SensorName,
+ SensorID,
+ CustomerID,
+ SensorStatus,
+ MinutesSinceLast,
+ TotalEvents,
+ UniqueSources,
+ FirstEvent,
+ LastEvent,
+ ProtocolStr
+version: 1.0.0
diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml
new file mode 100644
index 00000000000..cbaea89ce02
--- /dev/null
+++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml
@@ -0,0 +1,59 @@
+id: 73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d
+name: HoneyForge - High-Frequency Sensor Interactions
+description: |
+ Detects source IPs generating an unusually high volume of events against
+ HoneyForge sensors in a short window (more than 50 events in any 10-minute
+ period). This pattern is characteristic of automated scanners, brute-force
+ tools, or worm-like lateral movement.
+
+ High-frequency hits deserve immediate triage - especially if the source is
+ an internal IP, which would indicate a compromised or misconfigured device
+ inside the network.
+requiredDataConnectors:
+ - connectorId: HoneyForge
+ dataTypes:
+ - CommonSecurityLog
+tactics:
+ - Reconnaissance
+relevantTechniques:
+ - T1595
+ - T1190
+query: |
+ let lookback = 24h;
+ let burstWindow = 10m;
+ let burstThreshold = 50;
+ CommonSecurityLog
+ | where TimeGenerated >= ago(lookback)
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ SrcIpAddr = tostring(SourceIP),
+ SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),
+ CustomerID = tostring(DeviceCustomString2)
+ | where isnotempty(SrcIpAddr)
+ | summarize
+ BurstCount = count(),
+ SensorsHit = dcount(SensorName),
+ SensorList = make_set(SensorName, 10),
+ Protocols = make_set(tostring(Protocol), 5),
+ DestPorts = make_set(tostring(DestinationPort), 10),
+ WindowStart = min(TimeGenerated),
+ WindowEnd = max(TimeGenerated)
+ by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow)
+ | where BurstCount >= burstThreshold
+ | extend
+ SensorListStr = strcat_array(SensorList, ", "),
+ ProtocolStr = strcat_array(Protocols, ", "),
+ DestPortStr = strcat_array(DestPorts, ", ")
+ | sort by BurstCount desc
+ | project
+ SrcIpAddr,
+ CustomerID,
+ BurstCount,
+ SensorsHit,
+ WindowStart,
+ WindowEnd,
+ SensorListStr,
+ ProtocolStr,
+ DestPortStr
+version: 1.0.0
diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml
new file mode 100644
index 00000000000..81178f4a002
--- /dev/null
+++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml
@@ -0,0 +1,69 @@
+id: 5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e
+name: HoneyForge - Off-Hours Sensor Activity
+description: |
+ Surfaces HoneyForge sensor interactions that occurred outside normal business
+ hours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on
+ weekends). Off-hours activity from internal IPs is especially suspicious -
+ it may indicate a compromised device operating autonomously or an insider
+ threat.
+
+ Adjust the hour thresholds to match your organisation's working hours if
+ they differ from the defaults.
+requiredDataConnectors:
+ - connectorId: HoneyForge
+ dataTypes:
+ - CommonSecurityLog
+tactics:
+ - Reconnaissance
+relevantTechniques:
+ - T1595
+ - T1133
+query: |
+ let lookback = 7d;
+ let businessStart = 7; // 07:00 UTC
+ let businessEnd = 19; // 19:00 UTC
+ CommonSecurityLog
+ | where TimeGenerated >= ago(lookback)
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ SrcIpAddr = tostring(SourceIP),
+ SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),
+ CustomerID = tostring(DeviceCustomString2),
+ HourUTC = hourofday(TimeGenerated),
+ DayOfWeek = dayofweek(TimeGenerated)
+ | extend
+ IsOffHours = case(
+ // Weekend (Saturday = 6d, Sunday = 0d)
+ DayOfWeek == 0d or DayOfWeek == 6d, true,
+ // Outside business hours on weekdays
+ HourUTC < businessStart or HourUTC >= businessEnd, true,
+ false
+ )
+ | where IsOffHours == true
+ | where isnotempty(SrcIpAddr)
+ | summarize
+ TotalEvents = count(),
+ SensorsHit = dcount(SensorName),
+ SensorList = make_set(SensorName, 20),
+ FirstSeen = min(TimeGenerated),
+ LastSeen = max(TimeGenerated),
+ HoursActive = make_set(HourUTC, 24),
+ Protocols = make_set(tostring(Protocol), 10)
+ by SrcIpAddr, CustomerID
+ | sort by TotalEvents desc
+ | extend
+ SensorListStr = strcat_array(SensorList, ", "),
+ ProtocolStr = strcat_array(Protocols, ", "),
+ HoursStr = strcat_array(todynamic(tostring(HoursActive)), ", ")
+ | project
+ SrcIpAddr,
+ CustomerID,
+ TotalEvents,
+ SensorsHit,
+ FirstSeen,
+ LastSeen,
+ HoursStr,
+ SensorListStr,
+ ProtocolStr
+version: 1.0.0
diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml
new file mode 100644
index 00000000000..e69938a9225
--- /dev/null
+++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml
@@ -0,0 +1,59 @@
+id: e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b
+name: HoneyForge - Repeated Probes from Same Source
+description: |
+ Finds source IPs that have probed HoneyForge sensors on multiple distinct
+ occasions separated by at least one hour, suggesting deliberate or scripted
+ reconnaissance rather than a one-off event.
+
+ A legitimate network scanner that hits a sensor once might be an
+ oversight. One that returns hours or days later is a persistent threat.
+requiredDataConnectors:
+ - connectorId: HoneyForge
+ dataTypes:
+ - CommonSecurityLog
+tactics:
+ - Reconnaissance
+relevantTechniques:
+ - T1595
+ - T1590
+query: |
+ let lookback = 14d;
+ let minSessionGap = 1h;
+ let minReturnVisits = 2;
+ CommonSecurityLog
+ | where TimeGenerated >= ago(lookback)
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ SrcIpAddr = tostring(SourceIP),
+ SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))
+ | where isnotempty(SrcIpAddr)
+ | sort by SrcIpAddr asc, TimeGenerated asc
+ | serialize
+ | extend
+ PrevTime = prev(TimeGenerated, 1),
+ PrevSrc = prev(SrcIpAddr, 1)
+ | extend
+ IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1)
+ | summarize
+ TotalEvents = count(),
+ SessionCount = sumif(IsNewSession, IsNewSession == 1),
+ SensorsHit = dcount(SensorName),
+ FirstSeen = min(TimeGenerated),
+ LastSeen = max(TimeGenerated),
+ SensorList = make_set(SensorName, 20)
+ by SrcIpAddr
+ | where SessionCount >= minReturnVisits
+ | extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)
+ | sort by SessionCount desc, TotalEvents desc
+ | extend SensorListStr = strcat_array(SensorList, ", ")
+ | project
+ SrcIpAddr,
+ SessionCount,
+ TotalEvents,
+ SensorsHit,
+ DaySpan,
+ FirstSeen,
+ LastSeen,
+ SensorListStr
+version: 1.0.0
diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml
new file mode 100644
index 00000000000..60f8da9ae6f
--- /dev/null
+++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml
@@ -0,0 +1,55 @@
+id: 795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f
+name: HoneyForge - Top Attacking Source IPs
+description: |
+ Identifies the source IP addresses that have interacted most frequently with
+ HoneyForge deception sensors over the past 7 days. Repeat offenders across
+ multiple sensors are especially high-priority - they indicate persistent
+ reconnaissance or an automated scanner that missed the exclusion list.
+
+ Use this query as a starting point for threat-intel enrichment and to decide
+ which IPs warrant a block rule or further investigation.
+requiredDataConnectors:
+ - connectorId: HoneyForge
+ dataTypes:
+ - CommonSecurityLog
+tactics:
+ - Reconnaissance
+relevantTechniques:
+ - T1595
+ - T1590
+query: |
+ CommonSecurityLog
+ | where TimeGenerated >= ago(7d)
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ SrcIpAddr = tostring(SourceIP),
+ SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),
+ CustomerID = tostring(DeviceCustomString2)
+ | where isnotempty(SrcIpAddr)
+ | summarize
+ TotalEvents = count(),
+ SensorsHit = dcount(SensorName),
+ CustomersAffected = dcount(CustomerID),
+ FirstSeen = min(TimeGenerated),
+ LastSeen = max(TimeGenerated),
+ SensorList = make_set(SensorName, 20),
+ Protocols = make_set(tostring(Protocol), 10),
+ DestPorts = make_set(tostring(DestinationPort), 20)
+ by SrcIpAddr
+ | sort by TotalEvents desc
+ | extend
+ SensorListStr = strcat_array(SensorList, ", "),
+ ProtocolStr = strcat_array(Protocols, ", "),
+ DestPortStr = strcat_array(DestPorts, ", ")
+ | project
+ SrcIpAddr,
+ TotalEvents,
+ SensorsHit,
+ CustomersAffected,
+ FirstSeen,
+ LastSeen,
+ SensorListStr,
+ ProtocolStr,
+ DestPortStr
+version: 1.0.0
diff --git a/Solutions/HoneyForge/Package/3.0.0.zip b/Solutions/HoneyForge/Package/3.0.0.zip
new file mode 100644
index 00000000000..eae33e20006
Binary files /dev/null and b/Solutions/HoneyForge/Package/3.0.0.zip differ
diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json
new file mode 100644
index 00000000000..d07385e2836
--- /dev/null
+++ b/Solutions/HoneyForge/Package/createUiDefinition.json
@@ -0,0 +1,263 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+ "handler": "Microsoft.Azure.CreateUIDef",
+ "version": "0.1.2-preview",
+ "parameters": {
+ "config": {
+ "isWizard": false,
+ "basics": {
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "subscription": {
+ "resourceProviders": [
+ "Microsoft.OperationsManagement/solutions",
+ "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+ "Microsoft.Insights/workbooks",
+ "Microsoft.Logic/workflows"
+ ]
+ },
+ "location": {
+ "metadata": {
+ "hidden": "Hiding location, we get it from the log analytics workspace"
+ },
+ "visible": false
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Workspace",
+ "placeholder": "Select a workspace",
+ "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "dataconnectors",
+ "label": "Data Connectors",
+ "bladeTitle": "Data Connectors",
+ "elements": [
+ {
+ "name": "dataconnectors1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This Solution installs the data connector for HoneyForge. You can get HoneyForge CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+ }
+ },
+ {
+ "name": "dataconnectors-link1",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more about connecting data sources",
+ "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
+ }
+ }
+ }
+ ]
+ },
+ {
+ "name": "workbooks",
+ "label": "Workbooks",
+ "subLabel": {
+ "preValidation": "Configure the workbooks",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Workbooks",
+ "elements": [
+ {
+ "name": "workbooks-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
+ }
+ },
+ {
+ "name": "workbooks-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+ }
+ }
+ },
+ {
+ "name": "workbook1",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge Threat Detection",
+ "elements": [
+ {
+ "name": "workbook1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment."
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "name": "analytics",
+ "label": "Analytics",
+ "subLabel": {
+ "preValidation": "Configure the analytics",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Analytics",
+ "elements": [
+ {
+ "name": "analytics-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view."
+ }
+ },
+ {
+ "name": "analytics-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
+ }
+ }
+ },
+ {
+ "name": "analytic1",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - Deception Sensor Interaction",
+ "elements": [
+ {
+ "name": "analytic1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Detects an interaction with a HoneyForge deception sensor. Any activity\ninvolving a HoneyForge sensor must be treated as potentially unauthorised\nuntil validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices - legitimate systems and users\nshould never communicate with them. Any detected interaction may indicate\nnetwork scanning, lateral movement, or an actively compromised device."
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "name": "huntingqueries",
+ "label": "Hunting Queries",
+ "bladeTitle": "Hunting Queries",
+ "elements": [
+ {
+ "name": "huntingqueries-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. "
+ }
+ },
+ {
+ "name": "huntingqueries-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/hunting"
+ }
+ }
+ },
+ {
+ "name": "huntingquery1",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - Sensor Fleet Coverage and Health",
+ "elements": [
+ {
+ "name": "huntingquery1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Provides a per-sensor event summary for the past 30 days, giving visibility\ninto which sensors are active, which are quiet, and which may be offline or\nmisconfigured (no events in the last 10 minutes is the offline threshold).\n\nUse this query during routine operations to confirm full fleet coverage and\nidentify any gaps in your deception layer before an attacker does. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)"
+ }
+ }
+ ]
+ },
+ {
+ "name": "huntingquery2",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - High-Frequency Sensor Interactions",
+ "elements": [
+ {
+ "name": "huntingquery2-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Detects source IPs generating an unusually high volume of events against\nHoneyForge sensors in a short window (more than 50 events in any 10-minute\nperiod). This pattern is characteristic of automated scanners, brute-force\ntools, or worm-like lateral movement.\n\nHigh-frequency hits deserve immediate triage - especially if the source is\nan internal IP, which would indicate a compromised or misconfigured device\ninside the network. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)"
+ }
+ }
+ ]
+ },
+ {
+ "name": "huntingquery3",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - Off-Hours Sensor Activity",
+ "elements": [
+ {
+ "name": "huntingquery3-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Surfaces HoneyForge sensor interactions that occurred outside normal business\nhours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on\nweekends). Off-hours activity from internal IPs is especially suspicious -\nit may indicate a compromised device operating autonomously or an insider\nthreat.\n\nAdjust the hour thresholds to match your organisation's working hours if\nthey differ from the defaults. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)"
+ }
+ }
+ ]
+ },
+ {
+ "name": "huntingquery4",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - Repeated Probes from Same Source",
+ "elements": [
+ {
+ "name": "huntingquery4-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Finds source IPs that have probed HoneyForge sensors on multiple distinct\noccasions separated by at least one hour, suggesting deliberate or scripted\nreconnaissance rather than a one-off event.\n\nA legitimate network scanner that hits a sensor once might be an\noversight. One that returns hours or days later is a persistent threat. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)"
+ }
+ }
+ ]
+ },
+ {
+ "name": "huntingquery5",
+ "type": "Microsoft.Common.Section",
+ "label": "HoneyForge - Top Attacking Source IPs",
+ "elements": [
+ {
+ "name": "huntingquery5-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Identifies the source IP addresses that have interacted most frequently with\nHoneyForge deception sensors over the past 7 days. Repeat offenders across\nmultiple sensors are especially high-priority - they indicate persistent\nreconnaissance or an automated scanner that missed the exclusion list.\n\nUse this query as a starting point for threat-intel enrichment and to decide\nwhich IPs warrant a block rule or further investigation. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)"
+ }
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]"
+ }
+ }
+}
diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json
new file mode 100644
index 00000000000..cad72a4c0f1
--- /dev/null
+++ b/Solutions/HoneyForge/Package/mainTemplate.json
@@ -0,0 +1,1218 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "BUI - support@bui.co.za",
+ "comments": "Solution template for HoneyForge"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "HoneyForge Threat Detection",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ }
+ },
+ "variables": {
+ "email": "support@bui.co.za",
+ "_email": "[variables('email')]",
+ "_solutionName": "HoneyForge",
+ "_solutionVersion": "3.0.0",
+ "solutionId": "bui.honeyforge-threat-detection",
+ "_solutionId": "[variables('solutionId')]",
+ "workbookVersion1": "1.0.0",
+ "workbookContentId1": "HoneyForgeWorkbook",
+ "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+ "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+ "_workbookContentId1": "[variables('workbookContentId1')]",
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
+ "uiConfigId1": "HoneyForge",
+ "_uiConfigId1": "[variables('uiConfigId1')]",
+ "dataConnectorContentId1": "HoneyForge",
+ "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]",
+ "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "_dataConnectorId1": "[variables('dataConnectorId1')]",
+ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
+ "dataConnectorVersion1": "1.0.0",
+ "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
+ "analyticRuleObject1": {
+ "analyticRuleVersion1": "1.0.0",
+ "_analyticRulecontentId1": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2",
+ "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bb3b1339-c1fa-473a-8663-3fea78c2e7e2')]",
+ "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bb3b1339-c1fa-473a-8663-3fea78c2e7e2')))]",
+ "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bb3b1339-c1fa-473a-8663-3fea78c2e7e2','-', '1.0.0')))]"
+ },
+ "huntingQueryObject1": {
+ "huntingQueryVersion1": "1.0.0",
+ "_huntingQuerycontentId1": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c",
+ "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c')))]"
+ },
+ "huntingQueryObject2": {
+ "huntingQueryVersion2": "1.0.0",
+ "_huntingQuerycontentId2": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d",
+ "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d')))]"
+ },
+ "huntingQueryObject3": {
+ "huntingQueryVersion3": "1.0.0",
+ "_huntingQuerycontentId3": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e",
+ "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e')))]"
+ },
+ "huntingQueryObject4": {
+ "huntingQueryVersion4": "1.0.0",
+ "_huntingQuerycontentId4": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b",
+ "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b')))]"
+ },
+ "huntingQueryObject5": {
+ "huntingQueryVersion5": "1.0.0",
+ "_huntingQuerycontentId5": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f",
+ "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f')))]"
+ },
+ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('workbookTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge Workbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('workbookVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.Insights/workbooks",
+ "name": "[variables('workbookContentId1')]",
+ "location": "[parameters('workspace-location')]",
+ "kind": "shared",
+ "apiVersion": "2021-08-01",
+ "metadata": {
+ "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment."
+ },
+ "properties": {
+ "displayName": "[parameters('workbook1-name')]",
+ "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+ "version": "1.0",
+ "sourceId": "[variables('workspaceResourceId')]",
+ "category": "sentinel"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+ "properties": {
+ "description": "@{workbookKey=HoneyForgeWorkbook; logoFileName=HoneyForge.svg; description=Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=HoneyForge Threat Detection; templateRelativePath=HoneyForge.json; subtitle=; provider=BUI}.description",
+ "parentId": "[variables('workbookId1')]",
+ "contentId": "[variables('_workbookContentId1')]",
+ "kind": "Workbook",
+ "version": "[variables('workbookVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "contentId": "CommonSecurityLog",
+ "kind": "DataType"
+ },
+ {
+ "contentId": "CefAma",
+ "kind": "DataConnector"
+ }
+ ]
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_workbookContentId1')]",
+ "contentKind": "Workbook",
+ "displayName": "[parameters('workbook1-name')]",
+ "contentProductId": "[variables('_workbookcontentProductId1')]",
+ "id": "[variables('_workbookcontentProductId1')]",
+ "version": "[variables('workbookVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('dataConnectorTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge data connector with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+ "apiVersion": "2021-03-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GenericUI",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "[variables('_uiConfigId1')]",
+ "title": "HoneyForge Threat Detection",
+ "publisher": "BUI",
+ "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.",
+ "logo": "Logos/HoneyForgeLogo.svg",
+ "graphQueriesTableName": "CommonSecurityLog",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "HoneyForge sensor events",
+ "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\""
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All HoneyForge events — last 24 hours",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc"
+ },
+ {
+ "description": "Top source IPs interacting with sensors — last 7 days",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc"
+ },
+ {
+ "description": "Events by sensor — last 7 days",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc"
+ }
+ ],
+ "connectivityCriterias": [
+ {
+ "type": "IsConnectedQuery",
+ "value": [
+ "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)"
+ ]
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "CommonSecurityLog (HoneyForge)",
+ "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "read and write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true
+ }
+ },
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+ "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
+ "providerDisplayName": "Keys",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "action": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)"
+ },
+ {
+ "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)"
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema."
+ },
+ {
+ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend",
+ "innerSteps": [
+ {
+ "title": "1.1 — Install the Log Analytics agent and CEF collector",
+ "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.",
+ "instructions": [
+ {
+ "parameters": {
+ "fillWith": [
+ "WorkspaceId",
+ "PrimaryKey"
+ ],
+ "label": "Run on the Linux forwarder:",
+ "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}"
+ },
+ "type": "CopyableLabel"
+ }
+ ]
+ }
+ ],
+ "title": "Step 1 — Deploy the CEF syslog forwarder"
+ },
+ {
+ "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).",
+ "title": "Step 2 — Configure HoneyForge syslog forwarding"
+ },
+ {
+ "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:",
+ "instructions": [
+ {
+ "parameters": {
+ "fillWith": [
+ "WorkspaceId"
+ ],
+ "label": "Run the troubleshooter on the Linux forwarder:",
+ "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}"
+ },
+ "type": "CopyableLabel"
+ }
+ ],
+ "title": "Step 3 — Validate connectivity"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "contentKind": "DataConnector",
+ "displayName": "HoneyForge Threat Detection",
+ "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
+ "id": "[variables('_dataConnectorcontentProductId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "dependsOn": [
+ "[variables('_dataConnectorId1')]"
+ ],
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+ "apiVersion": "2021-03-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GenericUI",
+ "properties": {
+ "connectorUiConfig": {
+ "title": "HoneyForge Threat Detection",
+ "publisher": "BUI",
+ "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "HoneyForge sensor events",
+ "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\""
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "CommonSecurityLog (HoneyForge)",
+ "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriterias": [
+ {
+ "type": "IsConnectedQuery",
+ "value": [
+ "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)"
+ ]
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All HoneyForge events — last 24 hours",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc"
+ },
+ {
+ "description": "Top source IPs interacting with sensors — last 7 days",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc"
+ },
+ {
+ "description": "Events by sensor — last 7 days",
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "read and write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true
+ }
+ },
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
+ "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
+ "providerDisplayName": "Keys",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "action": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)"
+ },
+ {
+ "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)"
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema."
+ },
+ {
+ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend",
+ "innerSteps": [
+ {
+ "title": "1.1 — Install the Log Analytics agent and CEF collector",
+ "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.",
+ "instructions": [
+ {
+ "parameters": {
+ "fillWith": [
+ "WorkspaceId",
+ "PrimaryKey"
+ ],
+ "label": "Run on the Linux forwarder:",
+ "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}"
+ },
+ "type": "CopyableLabel"
+ }
+ ]
+ }
+ ],
+ "title": "Step 1 — Deploy the CEF syslog forwarder"
+ },
+ {
+ "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).",
+ "title": "Step 2 — Configure HoneyForge syslog forwarding"
+ },
+ {
+ "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:",
+ "instructions": [
+ {
+ "parameters": {
+ "fillWith": [
+ "WorkspaceId"
+ ],
+ "label": "Run the troubleshooter on the Linux forwarder:",
+ "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}"
+ },
+ "type": "CopyableLabel"
+ }
+ ],
+ "title": "Step 3 — Validate connectivity"
+ }
+ ],
+ "id": "[variables('_uiConfigId1')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_DeceptionSensorInteraction_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "NRT",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Detects an interaction with a HoneyForge deception sensor. Any activity\ninvolving a HoneyForge sensor must be treated as potentially unauthorised\nuntil validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices - legitimate systems and users\nshould never communicate with them. Any detected interaction may indicate\nnetwork scanning, lateral movement, or an actively compromised device.",
+ "displayName": "HoneyForge - Deception Sensor Interaction",
+ "enabled": false,
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(\n isempty(tostring(DeviceCustomString3)),\n tostring(Computer),\n tostring(DeviceCustomString3)\n ),\n EventType = iff(\n isempty(tostring(DeviceEventClassID)),\n \"unknown\",\n tostring(DeviceEventClassID)\n ),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(Computer), 10)\n by\n SrcIpAddr,\n DstIpAddr,\n SensorID,\n CustomerID,\n SensorName,\n EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated,\n FirstSeen,\n LastSeen,\n EventCount,\n SrcIpAddr,\n DstIpAddr,\n SourcePortList,\n DestinationPortList,\n ProtocolList,\n SensorID,\n SensorName,\n CustomerID,\n EventType,\n ActivityList,\n CEFSeverityList,\n DeviceVersionList,\n CollectorList\n",
+ "severity": "High",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "HoneyForge",
+ "dataTypes": [
+ "CommonSecurityLog"
+ ]
+ }
+ ],
+ "tactics": [
+ "Reconnaissance",
+ "InitialAccess"
+ ],
+ "techniques": [
+ "T1595",
+ "T1590",
+ "T1190",
+ "T1133"
+ ],
+ "entityMappings": [
+ {
+ "fieldMappings": [
+ {
+ "columnName": "SrcIpAddr",
+ "identifier": "Address"
+ }
+ ],
+ "entityType": "IP"
+ },
+ {
+ "fieldMappings": [
+ {
+ "columnName": "DstIpAddr",
+ "identifier": "Address"
+ }
+ ],
+ "entityType": "IP"
+ },
+ {
+ "fieldMappings": [
+ {
+ "columnName": "SensorName",
+ "identifier": "HostName"
+ }
+ ],
+ "entityType": "Host"
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "AlertPerResult"
+ },
+ "customDetails": {
+ "LastSeen": "LastSeen",
+ "EventType": "EventType",
+ "Activity": "ActivityList",
+ "SourcePorts": "SourcePortList",
+ "DeviceVersion": "DeviceVersionList",
+ "FirstSeen": "FirstSeen",
+ "Sensor": "SensorID",
+ "Customer": "CustomerID",
+ "SensorName": "SensorName",
+ "Collector": "CollectorList",
+ "DestinationPorts": "DestinationPortList",
+ "EventCount": "EventCount",
+ "Protocol": "ProtocolList"
+ },
+ "alertDetailsOverride": {
+ "alertDisplayNameFormat": "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}",
+ "alertDescriptionFormat": "HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}}\nusing {{ProtocolList}}. Treat this activity as unauthorised until validated.\n"
+ },
+ "incidentConfiguration": {
+ "groupingConfiguration": {
+ "enabled": true,
+ "groupByCustomDetails": [
+ "Customer",
+ "Sensor"
+ ],
+ "reopenClosedIncident": false,
+ "groupByEntities": [
+ "IP"
+ ],
+ "lookbackDuration": "4h",
+ "matchingMethod": "Selected"
+ },
+ "createIncident": true
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
+ "properties": {
+ "description": "HoneyForge Analytics Rule 1",
+ "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "HoneyForge - Deception Sensor Interaction",
+ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_FleetCoverage_HuntingQueries Hunting Query with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "HoneyForge_Hunting_Query_1",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "HoneyForge - Sensor Fleet Coverage and Health",
+ "category": "Hunting Queries",
+ "query": "let lookback = 30d;\nlet offlineThreshold = 10m;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n FirstEvent = min(TimeGenerated),\n LastEvent = max(TimeGenerated),\n Protocols = make_set(tostring(Protocol), 10)\n by SensorID, SensorName, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"Online\", \"Offline / No Recent Events\"),\n ProtocolStr = strcat_array(Protocols, \", \")\n| sort by SensorStatus asc, LastEvent desc\n| project\n SensorName,\n SensorID,\n CustomerID,\n SensorStatus,\n MinutesSinceLast,\n TotalEvents,\n UniqueSources,\n FirstEvent,\n LastEvent,\n ProtocolStr\n",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": "Provides a per-sensor event summary for the past 30 days, giving visibility\ninto which sensors are active, which are quiet, and which may be offline or\nmisconfigured (no events in the last 10 minutes is the offline threshold).\n\nUse this query during routine operations to confirm full fleet coverage and\nidentify any gaps in your deception layer before an attacker does."
+ },
+ {
+ "name": "tactics",
+ "value": "Reconnaissance"
+ },
+ {
+ "name": "techniques",
+ "value": "T1595,T1590"
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]",
+ "properties": {
+ "description": "HoneyForge Hunting Query 1",
+ "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]",
+ "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+ "kind": "HuntingQuery",
+ "version": "[variables('huntingQueryObject1').huntingQueryVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+ "contentKind": "HuntingQuery",
+ "displayName": "HoneyForge - Sensor Fleet Coverage and Health",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]",
+ "version": "1.0.0"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_HighFrequency_HuntingQueries Hunting Query with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "HoneyForge_Hunting_Query_2",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "HoneyForge - High-Frequency Sensor Interactions",
+ "category": "Hunting Queries",
+ "query": "let lookback = 24h;\nlet burstWindow = 10m;\nlet burstThreshold = 50;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n BurstCount = count(),\n SensorsHit = dcount(SensorName),\n SensorList = make_set(SensorName, 10),\n Protocols = make_set(tostring(Protocol), 5),\n DestPorts = make_set(tostring(DestinationPort), 10),\n WindowStart = min(TimeGenerated),\n WindowEnd = max(TimeGenerated)\n by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow)\n| where BurstCount >= burstThreshold\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| sort by BurstCount desc\n| project\n SrcIpAddr,\n CustomerID,\n BurstCount,\n SensorsHit,\n WindowStart,\n WindowEnd,\n SensorListStr,\n ProtocolStr,\n DestPortStr\n",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": "Detects source IPs generating an unusually high volume of events against\nHoneyForge sensors in a short window (more than 50 events in any 10-minute\nperiod). This pattern is characteristic of automated scanners, brute-force\ntools, or worm-like lateral movement.\n\nHigh-frequency hits deserve immediate triage - especially if the source is\nan internal IP, which would indicate a compromised or misconfigured device\ninside the network."
+ },
+ {
+ "name": "tactics",
+ "value": "Reconnaissance"
+ },
+ {
+ "name": "techniques",
+ "value": "T1595,T1190"
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]",
+ "properties": {
+ "description": "HoneyForge Hunting Query 2",
+ "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]",
+ "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+ "kind": "HuntingQuery",
+ "version": "[variables('huntingQueryObject2').huntingQueryVersion2]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+ "contentKind": "HuntingQuery",
+ "displayName": "HoneyForge - High-Frequency Sensor Interactions",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]",
+ "version": "1.0.0"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_OffHoursActivity_HuntingQueries Hunting Query with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "HoneyForge_Hunting_Query_3",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "HoneyForge - Off-Hours Sensor Activity",
+ "category": "Hunting Queries",
+ "query": "let lookback = 7d;\nlet businessStart = 7; // 07:00 UTC\nlet businessEnd = 19; // 19:00 UTC\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| extend\n IsOffHours = case(\n // Weekend (Saturday = 6d, Sunday = 0d)\n DayOfWeek == 0d or DayOfWeek == 6d, true,\n // Outside business hours on weekdays\n HourUTC < businessStart or HourUTC >= businessEnd, true,\n false\n )\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = make_set(SensorName, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n HoursActive = make_set(HourUTC, 24),\n Protocols = make_set(tostring(Protocol), 10)\n by SrcIpAddr, CustomerID\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n HoursStr = strcat_array(todynamic(tostring(HoursActive)), \", \")\n| project\n SrcIpAddr,\n CustomerID,\n TotalEvents,\n SensorsHit,\n FirstSeen,\n LastSeen,\n HoursStr,\n SensorListStr,\n ProtocolStr\n",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": "Surfaces HoneyForge sensor interactions that occurred outside normal business\nhours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on\nweekends). Off-hours activity from internal IPs is especially suspicious -\nit may indicate a compromised device operating autonomously or an insider\nthreat.\n\nAdjust the hour thresholds to match your organisation's working hours if\nthey differ from the defaults."
+ },
+ {
+ "name": "tactics",
+ "value": "Reconnaissance"
+ },
+ {
+ "name": "techniques",
+ "value": "T1595,T1133"
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]",
+ "properties": {
+ "description": "HoneyForge Hunting Query 3",
+ "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]",
+ "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+ "kind": "HuntingQuery",
+ "version": "[variables('huntingQueryObject3').huntingQueryVersion3]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+ "contentKind": "HuntingQuery",
+ "displayName": "HoneyForge - Off-Hours Sensor Activity",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]",
+ "version": "1.0.0"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_RepeatedProbes_HuntingQueries Hunting Query with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "HoneyForge_Hunting_Query_4",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "HoneyForge - Repeated Probes from Same Source",
+ "category": "Hunting Queries",
+ "query": "let lookback = 14d;\nlet minSessionGap = 1h;\nlet minReturnVisits = 2;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where isnotempty(SrcIpAddr)\n| sort by SrcIpAddr asc, TimeGenerated asc\n| serialize\n| extend\n PrevTime = prev(TimeGenerated, 1),\n PrevSrc = prev(SrcIpAddr, 1)\n| extend\n IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1)\n| summarize\n TotalEvents = count(),\n SessionCount = sumif(IsNewSession, IsNewSession == 1),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20)\n by SrcIpAddr\n| where SessionCount >= minReturnVisits\n| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)\n| sort by SessionCount desc, TotalEvents desc\n| extend SensorListStr = strcat_array(SensorList, \", \")\n| project\n SrcIpAddr,\n SessionCount,\n TotalEvents,\n SensorsHit,\n DaySpan,\n FirstSeen,\n LastSeen,\n SensorListStr\n",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": "Finds source IPs that have probed HoneyForge sensors on multiple distinct\noccasions separated by at least one hour, suggesting deliberate or scripted\nreconnaissance rather than a one-off event.\n\nA legitimate network scanner that hits a sensor once might be an\noversight. One that returns hours or days later is a persistent threat."
+ },
+ {
+ "name": "tactics",
+ "value": "Reconnaissance"
+ },
+ {
+ "name": "techniques",
+ "value": "T1595,T1590"
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]",
+ "properties": {
+ "description": "HoneyForge Hunting Query 4",
+ "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]",
+ "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+ "kind": "HuntingQuery",
+ "version": "[variables('huntingQueryObject4').huntingQueryVersion4]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+ "contentKind": "HuntingQuery",
+ "displayName": "HoneyForge - Repeated Probes from Same Source",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]",
+ "version": "1.0.0"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "HoneyForge_TopAttackingSources_HuntingQueries Hunting Query with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "HoneyForge_Hunting_Query_5",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "HoneyForge - Top Attacking Source IPs",
+ "category": "Hunting Queries",
+ "query": "CommonSecurityLog\n| where TimeGenerated >= ago(7d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n CustomersAffected = dcount(CustomerID),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20),\n Protocols = make_set(tostring(Protocol), 10),\n DestPorts = make_set(tostring(DestinationPort), 20)\n by SrcIpAddr\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| project\n SrcIpAddr,\n TotalEvents,\n SensorsHit,\n CustomersAffected,\n FirstSeen,\n LastSeen,\n SensorListStr,\n ProtocolStr,\n DestPortStr\n",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": "Identifies the source IP addresses that have interacted most frequently with\nHoneyForge deception sensors over the past 7 days. Repeat offenders across\nmultiple sensors are especially high-priority - they indicate persistent\nreconnaissance or an automated scanner that missed the exclusion list.\n\nUse this query as a starting point for threat-intel enrichment and to decide\nwhich IPs warrant a block rule or further investigation."
+ },
+ {
+ "name": "tactics",
+ "value": "Reconnaissance"
+ },
+ {
+ "name": "techniques",
+ "value": "T1595,T1590"
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]",
+ "properties": {
+ "description": "HoneyForge Hunting Query 5",
+ "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]",
+ "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+ "kind": "HuntingQuery",
+ "version": "[variables('huntingQueryObject5').huntingQueryVersion5]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+ "contentKind": "HuntingQuery",
+ "displayName": "HoneyForge - Top Attacking Source IPs",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]",
+ "version": "1.0.0"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "HoneyForge",
+ "publisherDisplayName": "BUI",
+ "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.
\nData Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "HoneyForge",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "BUI",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId1')]",
+ "version": "[variables('workbookVersion1')]"
+ },
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]",
+ "version": "[variables('huntingQueryObject1').huntingQueryVersion1]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]",
+ "version": "[variables('huntingQueryObject2').huntingQueryVersion2]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]",
+ "version": "[variables('huntingQueryObject3').huntingQueryVersion3]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]",
+ "version": "[variables('huntingQueryObject4').huntingQueryVersion4]"
+ },
+ {
+ "kind": "HuntingQuery",
+ "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]",
+ "version": "[variables('huntingQueryObject5').huntingQueryVersion5]"
+ }
+ ]
+ },
+ "firstPublishDate": "2026-07-20",
+ "lastPublishDate": "2026-07-20",
+ "categories": {
+ "domains": [
+ "Security - Threat Intelligence",
+ "Security - Network"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
diff --git a/Solutions/HoneyForge/Package/testParameters.json b/Solutions/HoneyForge/Package/testParameters.json
new file mode 100644
index 00000000000..ce2e02dbf30
--- /dev/null
+++ b/Solutions/HoneyForge/Package/testParameters.json
@@ -0,0 +1,32 @@
+{
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "HoneyForge Threat Detection",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ }
+}
diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml
new file mode 100644
index 00000000000..159a02985a8
--- /dev/null
+++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml
@@ -0,0 +1,76 @@
+id: b1b6b693-679e-4ebf-afc8-7faf6af266ab
+Function:
+ Title: HoneyForgeEvent
+ Version: '1.0.0'
+ LastUpdated: '2026-07-20'
+ Description: |
+ ASIM NetworkSession parser for HoneyForge Threat Detection Platform events.
+ Normalises CEF events from the CommonSecurityLog table (DeviceVendor="BUI",
+ DeviceProduct="HoneyForge") to the ASIM NetworkSession schema v0.2.6.
+ FunctionName: HoneyForgeEvent
+ FunctionAlias: HoneyForgeEvent
+ Category: Microsoft Sentinel Parser
+FunctionName: HoneyForgeEvent
+FunctionAlias: HoneyForgeEvent
+ParserParams:
+ - Name: starttime
+ Type: datetime
+ Default: datetime(null)
+ - Name: endtime
+ Type: datetime
+ Default: datetime(null)
+ - Name: srcipaddr_has_any_prefix
+ Type: dynamic
+ Default: dynamic([])
+ - Name: dstipaddr_has_any_prefix
+ Type: dynamic
+ Default: dynamic([])
+ - Name: ipaddr_has_any_prefix
+ Type: dynamic
+ Default: dynamic([])
+ - Name: dstportnumber
+ Type: int
+ Default: int(null)
+ - Name: hostname_has_any
+ Type: dynamic
+ Default: dynamic([])
+ - Name: disabled
+ Type: bool
+ Default: false
+FunctionQuery: |
+ CommonSecurityLog
+ | where DeviceVendor =~ "BUI"
+ | where DeviceProduct =~ "HoneyForge"
+ | extend
+ EventVendor = "BUI",
+ EventProduct = "HoneyForge",
+ EventProductVersion = tostring(DeviceVersion),
+ EventSchema = "NetworkSession",
+ EventSchemaVersion = "0.2.6",
+ EventType = "NetworkSession",
+ EventResult = "NA",
+ EventCount = int(1),
+ EventStartTime = TimeGenerated,
+ EventEndTime = TimeGenerated,
+ EventSeverity = case(
+ LogSeverity == "10", "High",
+ LogSeverity == "7", "Medium",
+ LogSeverity == "4", "Low",
+ "Informational"),
+ NetworkProtocol = case(
+ Protocol == "6", "TCP",
+ Protocol == "17", "UDP",
+ Protocol == "1", "ICMP",
+ tostring(Protocol)),
+ SrcIpAddr = tostring(SourceIP),
+ SrcPortNumber = toint(SourcePort),
+ DstIpAddr = tostring(DestinationIP),
+ DstPortNumber = toint(DestinationPort),
+ DstHostname = tostring(DestinationHostName),
+ DvcHostname = tostring(Computer),
+ DvcAction = "Detect",
+ AdditionalFields = bag_pack(
+ "SensorName", iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),
+ "CustomerID", tostring(DeviceCustomString2),
+ "ThreatName", tostring(Activity),
+ "RuleID", tostring(DeviceEventClassID))
diff --git a/Solutions/HoneyForge/ReleaseNotes.md b/Solutions/HoneyForge/ReleaseNotes.md
new file mode 100644
index 00000000000..2cbab5e1951
--- /dev/null
+++ b/Solutions/HoneyForge/ReleaseNotes.md
@@ -0,0 +1,3 @@
+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
+|------------|-------------------------------|-------------------|
+| 3.0.0 | 09-10-2026 | Initial release of HoneyForge Threat Detection solution |
diff --git a/Solutions/HoneyForge/SolutionMetadata.json b/Solutions/HoneyForge/SolutionMetadata.json
new file mode 100644
index 00000000000..32f68167749
--- /dev/null
+++ b/Solutions/HoneyForge/SolutionMetadata.json
@@ -0,0 +1,51 @@
+{
+ "publisherId": "bui",
+ "offerId": "honeyforge-threat-detection",
+ "firstPublishDate": "2026-07-20",
+ "lastPublishDate": "2026-07-20",
+ "provider": "BUI",
+ "categories": {
+ "domains": [
+ "Security - Threat Intelligence",
+ "Security - Network"
+ ]
+ },
+ "support": {
+ "name": "BUI",
+ "email": "support@bui.co.za",
+ "tier": "Partner",
+ "link": "https://honeyforge.tech"
+ },
+ "industry": {},
+ "recommendedBy": [],
+ "learningResources": [
+ {
+ "title": "HoneyForge Documentation",
+ "description": "Product documentation and user manual for the HoneyForge Threat Detection Platform.",
+ "type": "Documentation",
+ "url": "https://honeyforge.tech"
+ }
+ ],
+ "threatAnalysisTactics": [
+ "Reconnaissance",
+ "InitialAccess"
+ ],
+ "threatAnalysisTechniques": [],
+ "prerequisites": "To integrate with HoneyForge:\n\n1. A HoneyForge subscription and at least one deployed sensor.\n2. A Linux machine to host the CEF syslog forwarder (can be the same machine as the Log Analytics agent).\n3. Outbound TCP/UDP 514 allowed from the forwarder to the syslog collector.\n\nContact BUI at support@bui.co.za to obtain your HoneyForge subscription.",
+ "version": "1.0.0",
+ "title": "HoneyForge Threat Detection",
+ "description": "HoneyForge is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect and alert on malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog, and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook to help your security team identify, investigate, and respond to threats detected by the platform.",
+ "logo": "Logos/HoneyForgeLogo.svg",
+ "contentSchemaVersion": "3.0.0",
+ "packagedContent": [],
+ "initialDisplayState": "expanded",
+ "metadata": {
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "c1fd352d-366b-4853-8511-9fa254b8a8a8",
+ "contentKind": "Solution",
+ "displayName": "HoneyForge Threat Detection",
+ "contentProductId": "bui-honeyforge-threat-detection",
+ "id": "c1fd352d-366b-4853-8511-9fa254b8a8a8",
+ "version": "1.0.0"
+ }
+}
diff --git a/Solutions/HoneyForge/Workbooks/HoneyForge.json b/Solutions/HoneyForge/Workbooks/HoneyForge.json
new file mode 100644
index 00000000000..448df7f299c
--- /dev/null
+++ b/Solutions/HoneyForge/Workbooks/HoneyForge.json
@@ -0,0 +1,228 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "a1b2c3d4-0001-0000-0000-000000000001",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "value": {
+ "durationMs": 604800000
+ },
+ "typeSettings": {
+ "selectableValues": [
+ { "durationMs": 3600000 },
+ { "durationMs": 14400000 },
+ { "durationMs": 43200000 },
+ { "durationMs": 86400000 },
+ { "durationMs": 259200000 },
+ { "durationMs": 604800000 },
+ { "durationMs": 2592000000 }
+ ],
+ "allowCustom": true
+ }
+ },
+ {
+ "id": "a1b2c3d4-0002-0000-0000-000000000002",
+ "version": "KqlParameterItem/1.0",
+ "name": "CustomerID",
+ "label": "Customer",
+ "type": 2,
+ "isRequired": false,
+ "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(CustomerID)\n| distinct CustomerID\n| sort by CustomerID asc",
+ "value": "All",
+ "typeSettings": {
+ "additionalResourceOptions": ["value:All"],
+ "showDefault": false
+ },
+ "defaultValue": "value:All",
+ "timeContext": { "durationMs": 0 },
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "parameters"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "# HoneyForge Threat Detection\n---\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated."
+ },
+ "name": "header"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\n CustomersAffected = dcount(CustomerID)\n| extend\n TotalEventsLabel = tostring(TotalEvents),\n UniqueSourcesLabel = tostring(UniqueSources),\n SensorsHitLabel = tostring(SensorsHit),\n CustomersLabel = tostring(CustomersAffected)",
+ "size": 4,
+ "title": "Overview",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "tiles",
+ "tileSettings": {
+ "titleContent": {
+ "columnMatch": "TotalEventsLabel",
+ "formatter": 12,
+ "formatOptions": { "palette": "auto" }
+ },
+ "showBorder": false,
+ "tiles": [
+ { "id": "tile-events", "title": "Total Events", "query": "TotalEventsLabel" },
+ { "id": "tile-sources", "title": "Unique Source IPs", "query": "UniqueSourcesLabel" },
+ { "id": "tile-sensors", "title": "Sensors Triggered", "query": "SensorsHitLabel" },
+ { "id": "tile-customers","title": "Customers Affected", "query": "CustomersLabel" }
+ ]
+ }
+ },
+ "name": "overview-tiles"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by bin(TimeGenerated, 1h)\n| sort by TimeGenerated asc",
+ "size": 0,
+ "title": "Event Timeline",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "timechart",
+ "chartSettings": {
+ "seriesLabelSettings": [
+ { "seriesName": "Events", "color": "blue" }
+ ]
+ }
+ },
+ "name": "timeline"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = strcat_array(make_set(SensorName, 10), \", \"),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr\n| sort by TotalEvents desc\n| take 25",
+ "size": 0,
+ "title": "Top 25 Attacking Source IPs",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "TotalEvents",
+ "formatter": 8,
+ "formatOptions": { "palette": "redBright" }
+ }
+ ],
+ "sortBy": [{ "itemKey": "TotalEvents", "sortOrder": 2 }]
+ }
+ },
+ "name": "top-sources"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n SensorID = tostring(DeviceCustomString1)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n LastEvent = max(TimeGenerated)\n by SensorName, SensorID, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"🟢 Online\", \"🔴 Offline\")\n| sort by Status asc, TotalEvents desc\n| project\n Status,\n SensorName,\n SensorID,\n CustomerID,\n TotalEvents,\n UniqueSources,\n LastEvent,\n MinutesSinceLast",
+ "size": 0,
+ "title": "Sensor Fleet Health",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Status",
+ "formatter": 1
+ },
+ {
+ "columnMatch": "TotalEvents",
+ "formatter": 8,
+ "formatOptions": { "palette": "blue" }
+ }
+ ]
+ }
+ },
+ "name": "sensor-health"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n Severity = case(\n toint(LogSeverity) >= 9, \"Critical\",\n toint(LogSeverity) >= 7, \"High\",\n toint(LogSeverity) >= 4, \"Medium\",\n \"Low\"\n )\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by Severity\n| sort by Events desc",
+ "size": 3,
+ "title": "Events by Severity",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart",
+ "chartSettings": {
+ "seriesLabelSettings": [
+ { "seriesName": "Critical", "color": "redBright" },
+ { "seriesName": "High", "color": "red" },
+ { "seriesName": "Medium", "color": "orange" },
+ { "seriesName": "Low", "color": "yellow" }
+ ]
+ }
+ },
+ "name": "severity-chart",
+ "styleSettings": { "maxWidth": "50%" }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n EventProtocol = tostring(Protocol)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(EventProtocol)\n| summarize Events = count() by EventProtocol\n| sort by Events desc",
+ "size": 3,
+ "title": "Events by Protocol",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "piechart"
+ },
+ "name": "protocol-chart",
+ "styleSettings": { "maxWidth": "50%" }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n Events = count(),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr, CustomerID\n| sort by Events desc\n| take 20",
+ "size": 0,
+ "title": "Off-Hours Activity (Top 20 Sources)",
+ "timeContextFromParameter": "TimeRange",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Events",
+ "formatter": 8,
+ "formatOptions": { "palette": "orange" }
+ }
+ ]
+ }
+ },
+ "name": "offhours"
+ }
+ ],
+ "styleSettings": {},
+ "fromTemplateId": "sentinel-HoneyForge",
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
diff --git a/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeBlack.png b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeBlack.png
new file mode 100644
index 00000000000..abd740d12ff
Binary files /dev/null and b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeBlack.png differ
diff --git a/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeWhite.png b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeWhite.png
new file mode 100644
index 00000000000..3248bf9dcba
Binary files /dev/null and b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeWhite.png differ
diff --git a/Workbooks/Images/Logos/HoneyForge.svg b/Workbooks/Images/Logos/HoneyForge.svg
new file mode 100644
index 00000000000..561462a008a
--- /dev/null
+++ b/Workbooks/Images/Logos/HoneyForge.svg
@@ -0,0 +1,8 @@
+
+
\ No newline at end of file
diff --git a/Workbooks/Images/Preview/HoneyForgeBlack.png b/Workbooks/Images/Preview/HoneyForgeBlack.png
new file mode 100755
index 00000000000..abd740d12ff
Binary files /dev/null and b/Workbooks/Images/Preview/HoneyForgeBlack.png differ
diff --git a/Workbooks/Images/Preview/HoneyForgeWhite.png b/Workbooks/Images/Preview/HoneyForgeWhite.png
new file mode 100755
index 00000000000..3248bf9dcba
Binary files /dev/null and b/Workbooks/Images/Preview/HoneyForgeWhite.png differ
diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 10c40690b8a..7cb1c90f448 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -3058,7 +3058,7 @@
"dataTypesDependencies": [
"DeviceNetworkEvents",
"DeviceProcessEvents"
- ],
+ ],
"dataConnectorsDependencies": [],
"previewImagesFileNames": [
"AIGovernanceBlack.png",
@@ -10833,7 +10833,7 @@
"subtitle": "",
"provider": "Google"
},
-{
+ {
"workbookKey": "DatawizaAccessProxyDashboard",
"logoFileName": "datawiza_logo.svg",
"description": "Datawiza Access Proxy Dashboard. Unified monitoring of DAP traffic, policy decisions, authentication activity, and error trends ingested into Microsoft Sentinel.",
@@ -11287,14 +11287,14 @@
"logoFileName": "DomainTools.svg",
"description": "# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types.",
"dataTypesDependencies": [
- "DomainToolsThreatIntelDomains_CL"
+ "DomainToolsThreatIntelDomains_CL"
],
"dataConnectorsDependencies": [
- "DomainToolsCCFDefinition"
+ "DomainToolsCCFDefinition"
],
"previewImagesFileNames": [
- "DomainToolsCCFWorkbookWhite.png",
- "DomainToolsCCFWorkbookBlack.png"
+ "DomainToolsCCFWorkbookWhite.png",
+ "DomainToolsCCFWorkbookBlack.png"
],
"version": "1.0",
"title": "DomainTools Threat Intelligence CCF Dashboards",
@@ -11810,5 +11810,25 @@
"templateRelativePath": "NetcraftAdvertResultOperations.json",
"subtitle": "",
"provider": "Netcraft"
+ },
+ {
+ "workbookKey": "HoneyForgeWorkbook",
+ "logoFileName": "HoneyForge.svg",
+ "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.",
+ "dataTypesDependencies": [
+ "CommonSecurityLog"
+ ],
+ "dataConnectorsDependencies": [
+ "CefAma"
+ ],
+ "previewImagesFileNames": [
+ "HoneyForgeBlack.png",
+ "HoneyForgeWhite.png"
+ ],
+ "version": "1.0.0",
+ "title": "HoneyForge Threat Detection",
+ "templateRelativePath": "HoneyForge.json",
+ "subtitle": "",
+ "provider": "BUI"
}
-]
+]
\ No newline at end of file