{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Lookout Mobile Security - Executive Dashboard\n\n**Real-time mobile device and security monitoring**"
      },
      "name": "text - title"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "TimeRange",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {"durationMs": 3600000},
                {"durationMs": 86400000},
                {"durationMs": 259200000},
                {"durationMs": 604800000},
                {"durationMs": 2592000000}
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count()",
        "size": 4,
        "title": "Total Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {"columnMatch": "Count", "formatter": 1},
          "leftContent": {"columnMatch": "Count", "formatter": 12, "formatOptions": {"palette": "blue"}},
          "showBorder": true
        }
      },
      "customWidth": "20",
      "name": "query - total events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| summarize Count = dcount(tostring(device.guid))",
        "size": 4,
        "title": "Unique Devices",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {"columnMatch": "Count", "formatter": 1},
          "leftContent": {"columnMatch": "Count", "formatter": 12, "formatOptions": {"palette": "green"}},
          "showBorder": true
        }
      },
      "customWidth": "20",
      "name": "query - unique devices"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| summarize Count = count()",
        "size": 4,
        "title": "Audit Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {"columnMatch": "Count", "formatter": 1},
          "leftContent": {"columnMatch": "Count", "formatter": 12, "formatOptions": {"palette": "orange"}},
          "showBorder": true
        }
      },
      "customWidth": "20",
      "name": "query - audit events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"THREAT\"\n| summarize Count = count()",
        "size": 4,
        "title": "Threat Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {"columnMatch": "Count", "formatter": 1},
          "leftContent": {"columnMatch": "Count", "formatter": 12, "formatOptions": {"palette": "red"}},
          "showBorder": true
        }
      },
      "customWidth": "20",
      "name": "query - threat events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"SMISHING_ALERT\"\n| summarize Count = count()",
        "size": 4,
        "title": "Smishing Alerts",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {"columnMatch": "Count", "formatter": 1},
          "leftContent": {"columnMatch": "Count", "formatter": 12, "formatOptions": {"palette": "purple"}},
          "showBorder": true
        }
      },
      "customWidth": "20",
      "name": "query - smishing alerts"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by log_type\n| render piechart",
        "size": 0,
        "title": "Event Distribution",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "query - event distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend Platform = tostring(device.platform)\n| summarize Count = count() by Platform",
        "size": 0,
        "title": "Devices by Platform",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "query - platform distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend AuditType = tostring(audit.type)\n| summarize Count = count() by AuditType\n| order by Count desc",
        "size": 0,
        "title": "Audit Events by Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "columnchart"
      },
      "customWidth": "34",
      "name": "query - audit types"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by bin(TimeGenerated, 1h), log_type\n| render timechart",
        "size": 0,
        "title": "Event Timeline",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - timeline"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend \n    Email = tostring(device.info.email),\n    Platform = tostring(device.platform),\n    Manufacturer = tostring(device.hardware.manufacturer),\n    Model = tostring(device.hardware.model),\n    ActivationStatus = tostring(device.status.activation_status)\n| summarize \n    LastSeen = max(TimeGenerated),\n    arg_max(TimeGenerated, *)\n    by Email\n| project \n    Email,\n    Platform,\n    Device = strcat(Manufacturer, \" \", Model),\n    ActivationStatus,\n    LastSeen\n| order by LastSeen desc\n| take 20",
        "size": 0,
        "title": "Recent Device Activity",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ActivationStatus",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {"operator": "==", "thresholdValue": "ACTIVE", "representation": "green", "text": "{0}"},
                  {"operator": "==", "thresholdValue": "PENDING", "representation": "yellow", "text": "{0}"},
                  {"operator": "Default", "representation": "gray", "text": "{0}"}
                ]
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "query - recent devices"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend \n    AuditType = tostring(audit.type),\n    ActorType = tostring(actor.type)\n| project \n    TimeGenerated,\n    AuditType,\n    ActorType\n| order by TimeGenerated desc\n| take 20",
        "size": 0,
        "title": "Recent Audit Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "query - recent audits"
    }
  ],
  "styleSettings": {},
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}