{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "6f7b06e9-6ae9-47e4-974b-85b998d96c1d",
                        "version": "KqlParameterItem/1.0",
                        "name": "Time",
                        "type": 4,
                        "typeSettings": {
                            "selectableValues": [
                                {
                                    "durationMs": 300000
                                },
                                {
                                    "durationMs": 900000
                                },
                                {
                                    "durationMs": 1800000
                                },
                                {
                                    "durationMs": 3600000
                                },
                                {
                                    "durationMs": 14400000
                                },
                                {
                                    "durationMs": 43200000
                                },
                                {
                                    "durationMs": 86400000
                                },
                                {
                                    "durationMs": 172800000
                                },
                                {
                                    "durationMs": 259200000
                                },
                                {
                                    "durationMs": 604800000
                                },
                                {
                                    "durationMs": 1209600000
                                },
                                {
                                    "durationMs": 2419200000
                                },
                                {
                                    "durationMs": 2592000000
                                },
                                {
                                    "durationMs": 5184000000
                                },
                                {
                                    "durationMs": 7776000000
                                }
                            ],
                            "allowCustom": true
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        },
                        "value": {
                            "durationMs": 86400000
                        }
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 3"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BitwardenEventLogs | where eventType >= 1100 and eventType < 1200 | extend country = geo_info_from_ip_address(ipAddress).country | where country != \"\"",
                "size": 3,
                "title": "Vault Item Events by Country",
                "timeContextFromParameter": "Time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "map",
                "mapSettings": {
                    "locInfo": "CountryRegion",
                    "locInfoColumn": "country",
                    "sizeSettings": "country",
                    "sizeAggregation": "Count",
                    "legendMetric": "country",
                    "legendAggregation": "Count",
                    "itemColorSettings": {
                        "nodeColorField": "eventType",
                        "colorAggregation": "Sum",
                        "type": "heatmap",
                        "heatmapPalette": "greenRed"
                    }
                }
            },
            "name": "query - 4"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BitwardenEventLogs | where eventType >= 1100 and eventType < 1200 | summarize deviceCount = count() by deviceName, bin(TimeGenerated, 1h) | sort by TimeGenerated desc",
                "size": 1,
                "showAnalytics": true,
                "title": "Vault Item Events by Device",
                "timeContextFromParameter": "Time",
                "showExportToExcel": true,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "linechart"
            },
            "customWidth": "50",
            "showPin": true,
            "name": "query - 1"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BitwardenEventLogs | where eventType >= 1100 and eventType < 1200 | summarize eventTypeCount = count() by eventTypeName, bin(TimeGenerated, 1h) | sort by TimeGenerated desc",
                "size": 1,
                "showAnalytics": true,
                "title": "Vault Item Events by Type",
                "timeContextFromParameter": "Time",
                "showExportToExcel": true,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "linechart"
            },
            "customWidth": "50",
            "showPin": true,
            "name": "query - 1 - Copy"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "3dffc9fc-e511-4ce5-9526-8f18c19df622",
                        "version": "KqlParameterItem/1.0",
                        "name": "TopUsersBy",
                        "label": "Top Users By",
                        "type": 2,
                        "typeSettings": {
                            "showDefault": false
                        },
                        "jsonData": "[ { \"value\": \"actingUserId\", \"label\": \"User ID\", \"selected\": false }, { \"value\": \"actingUserEmail\", \"label\": \"User Email\", \"selected\": true }, { \"value\": \"actingUserName\", \"label\": \"User Name\", \"selected\": false } ]",
                        "timeContext": {
                            "durationMs": 86400000
                        }
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BitwardenEventLogs | where eventType >= 1100 and eventType < 1200 | where actingUserId != \"\" and {TopUsersBy} != \"\" | summarize userCount = count() by {TopUsersBy}",
                "size": 1,
                "showAnalytics": true,
                "title": "Top Vault Item Event Users",
                "timeContextFromParameter": "Time",
                "showExportToExcel": true,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "barchart",
                "tileSettings": {
                    "showBorder": false,
                    "titleContent": {
                        "columnMatch": "eventTypeName",
                        "formatter": 1
                    },
                    "leftContent": {
                        "columnMatch": "eventType",
                        "formatter": 12,
                        "formatOptions": {
                            "palette": "auto"
                        },
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "maximumSignificantDigits": 3,
                                "maximumFractionDigits": 2
                            }
                        }
                    }
                },
                "graphSettings": {
                    "type": 0,
                    "topContent": {
                        "columnMatch": "eventTypeName",
                        "formatter": 1
                    },
                    "centerContent": {
                        "columnMatch": "eventType",
                        "formatter": 1,
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "maximumSignificantDigits": 3,
                                "maximumFractionDigits": 2
                            }
                        }
                    }
                }
            },
            "customWidth": "50",
            "showPin": true,
            "name": "query - 1 - Copy - Copy"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BitwardenEventLogs | where eventType >= 1100 and eventType < 1200",
                "size": 3,
                "title": "Latest Vault Item Events",
                "timeContextFromParameter": "Time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "gridSettings": {
                    "formatters": [
                        {
                            "columnMatch": "TimeGenerated",
                            "formatter": 6
                        },
                        {
                            "columnMatch": "ipAddress",
                            "formatter": 17
                        }
                    ]
                }
            },
            "name": "query - 6"
        }
    ],
    "styleSettings": {
        "spacingStyle": "none"
    },
    "fromTemplateId": "sentinel-BitwardenEventLogsVaultItems",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}