{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "NC Protect"
      },
      "name": "text - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NCProtectUAL_CL | where TimeGenerated > ago(7d) | order by TimeGenerated desc ",
              "size": 0,
              "title": "Get last 7 days records",
              "timeContext": {
                "durationMs": 259200000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 1",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NCProtectUAL_CL | where TimeGenerated > ago(1h) and Type_s == 'LoginFailure' | summarize FailedRequestCount = count() by bin(TimeGenerated, 1h), UserDisplayName_s, UserEmail_s, UserLoginName_s, Type_s, JSONExtra_s | where  FailedRequestCount > 3 ",
              "size": 0,
              "title": "Login failed consecutively for more than 3 times in an hour by user",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 2",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NCProtectUAL_CL | where TimeGenerated > ago(1h) and Type_s == 'Open' and Status_s == 'Fail' | summarize FailedRequestCount = count() by bin(TimeGenerated, 1h), UserDisplayName_s, UserEmail_s, UserLoginName_s, Type_s, JSONExtra_s, DocumentUrl_s | where  FailedRequestCount > 3 ",
              "size": 0,
              "title": "Download failed consecutively for more than 3 times in an hour by user",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 3",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NCProtectUAL_CL | where TimeGenerated > ago(7d) and (Type_s == 'Create' or Type_s == 'Modify' or Type_s == 'Delete') and isnotempty(RuleName_s) | order by TimeGenerated desc ",
              "size": 0,
              "title": "Get logs for rule created or modified or deleted records in last 7 days",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 4",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 0"
    }
  ]
}