Adding a new workook for MicrosoftTeams

[samikroy]

Change(s):

Azure-Sentinel/Workbooks/MicrosoftTeams.json- A new workbook added with the following tabs
Overview - An overview of Microsoft Teams logs in OfficeActivity.
Admin Activity - Administration activities in Microsoft Teams.
External User Activity - External user activities
Hunting - Hunting activities in Microsoft Teams.

Azure-Sentinel/Workbooks/WorkbooksMetadata.json - To add workbook metadata.

Azure-Sentinel/Workbooks/Images/Logos - To add workbook logo.

Azure-Sentinel/Workbooks/Images/Preview - To add preview images.

[samikroy]

@vmanojreddy & @NikTripathi - Could you please help in merging this approved one.

[v-marimanda]

@samikroy Workbooks Queries are failing. Please look into it.

[samikroy]

vmanojreddy

Thank you for sharing this @vmanojreddy , have updated the file with the fix, please review.

[samikroy]

Thank you for approval @vmanojreddy & thank you for the merge @NikTripathi.

[NikTripathi]

@samikroy We already have solution for teams, Should we include it as part of the solution or standalone?

[samikroy]

@NikTripathi - Please include this also as a part of the existing solution.
Created a new folder structure as could not find it in the solution folder with another PR.
Current PR #4128 is for this being available as a workbook & PR #4289 is for the workbook being a part of the solution.
Let me know for any for updates to the source code.
Thank you.

[NikTripathi]

@NikTripathi - Please include this also as a part of the existing solution. Created a new folder structure as could not find it in the solution folder with another PR. Current PR #4128 is for this being available as a workbook & PR #4289 is for the workbook being a part of the solution. Let me know for any for updates to the source code. Thank you.

Hi @samikroy . Do we need it as a standalone workbook if it's part of a solution and being distributed as a solution? As a stand-alone, I believe it should be removed. Please let me know what you think. Thanks.

[samikroy]

@NikTripathi - Please include this also as a part of the existing solution. Created a new folder structure as could not find it in the solution folder with another PR. Current PR #4128 is for this being available as a workbook & PR #4289 is for the workbook being a part of the solution. Let me know for any for updates to the source code. Thank you.

Hi @samikroy . Do we need it as a standalone workbook if it's part of a solution and being distributed as a solution? As a stand-alone, I believe it should be removed. Please let me know what you think. Thanks.

@NikTripathi - Thank you for sharing your insights.
As have seen customers of categories

1.Only want to monitor teams activity.
2.Evaluatng the insights on a teams pilot phase.
3.Want to enable hunting & analytic for Teams.

For #1 & #2 the standalone workbook will enable to view the details from template gallery with MS/ Community updates.
#3 - Solution is a best fit.

Reasons for 2 different PRs are

a. There is not way to link a gallery workbook template in solution (happy to link when it is available as this will reduce the maintenance.)
b. No option to cherry pick components from solution.
c. Have seen this solution having existing analytic rules #1068

Component seems duplicated for increasing the solution (workbook) available more to bigger set of customers.
But, will let the MS product teams decide on the availability of both.
Thank you.