{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Trend Micro Deep Security Events"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "94910267-b8f6-4b30-aa2f-e5780ad9738e",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Anti-Malware"
      },
      "name": "text - 29"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName  == \"Anti-Malware\" \r\n| summarize count() by DeviceAction, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Anti-Malware Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Anti-Malware Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Anti-Malware\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Top 5 Detected Malware",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Top 5 Detected Malware",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Anti-Malware\"\r\n| summarize Events=count(DeviceName) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Top 5 Infected Computers",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Top 5 Infected Computers",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Firewall"
      },
      "name": "text - 29 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName  == \"Firewall\"\r\n| where Activity !contains \"Reconnaissance\"\r\n| summarize count() by DeviceAction, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Firewall Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Firewall Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Firewall\"\r\n| where Activity !contains \"Reconnaissance\"\r\n| where DeviceAction == \"Deny\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Firewall Activity (Prevented)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Firewall Activity (Prevented)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Firewall\"\r\n| where Activity !contains \"Reconnaissance\"\r\n| where DeviceAction == \"IDS:Deny\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Firewall Activity (Detected)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Firewall Activity (Detected)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Firewall\"\r\n| where Activity !contains \"Reconnaissance\"\r\n| where DeviceAction == \"Deny\"\r\n| summarize Events=count(DeviceName) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Firewall Computer Activity (Prevented)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Firewall Computer Activity (Prevented)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Firewall\"\r\n| where Activity !contains \"Reconnaissance\"\r\n| where DeviceAction == \"IDS:Deny\"\r\n| summarize Events=count(DeviceName) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Firewall Computer Activity (Detected)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Firewall Computer Activity (Detected)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Integrity Monitoring"
      },
      "name": "text - 29 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendMicroDeepSecurity \r\n| where DeepSecurityModuleName == \"Integrity Monitoring\"\r\n| extend severity = case(LogSeverity == 3, \"Low\", \r\n                         LogSeverity == 6, \"Medium\",\r\n                         LogSeverity == 8, \"High\", \r\n                         \"Critical\")\r\n| summarize count() by severity, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Integrity Monitoring Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Integrity Monitoring Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Integrity Monitoring\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Integrity Monitoring Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Integrity Monitoring Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Integrity Monitoring\"\r\n| summarize Events=count(Activity) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Integrity Monitoring Computer Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Integrity Monitoring Computer Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Intrusion Prevention"
      },
      "name": "text - 29 - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName  == \"Intrusion Prevention\"\r\n| summarize count() by DeviceAction, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Intrusion Prevention Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Intrusion Prevention Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Intrusion Prevention\"\r\n| where DeviceAction == \"Reset\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "IPS Activity (Prevented)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "IPS Activity (Prevented)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Intrusion Prevention\"\r\n| where DeviceAction == \"IDS:Reset\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "IPS Activity (Detected)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "IPS Activity (Detected)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Intrusion Prevention\"\r\n| where DeviceAction == \"Reset\"\r\n| summarize Events=count(DeviceName) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "IPS Computer Activity (Prevented)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "IPS Computer Activity (Prevented)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Intrusion Prevention\"\r\n| where DeviceAction == \"IDS:Reset\"\r\n| summarize Events=count(DeviceName) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "IPS Computer Activity (Detected)",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "IPS Computer Activity (Detected)",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Log Inspection"
      },
      "name": "text - 29 - Copy - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendMicroDeepSecurity \r\n| where DeepSecurityModuleName == \"Log Inspection\"\r\n| extend severity = case(LogSeverity == 3, \"Low\", \r\n                         LogSeverity == 6, \"Medium\",\r\n                         LogSeverity == 8, \"High\", \r\n                         \"Critical\")\r\n| summarize count() by severity, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Log Inspection Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Log Inspection Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Log Inspection\"\r\n| summarize Events=count(Activity) by Rule=Activity\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Log Inspection Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Log Inspection Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Log Inspection\"\r\n| summarize Events=count(LIDescription) by Event=LIDescription\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Log Inspection Description Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Log Inspection Description Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Log Inspection\"\r\n| summarize Events=count(Activity) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Log Inspection Computer Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Log Inspection Computer Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n## Web Reputation"
      },
      "name": "text - 29 - Copy - Copy - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName  == \"Web Reputation\"\r\n| summarize count() by Message, bin(TimeGenerated, 1h)",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Web Reputation Event History",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "name": "Web Reputation Event History"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Web Reputation\"\r\n| summarize Events=count(RequestURL) by URL=RequestURL\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Web Reputation URL Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Web Reputation URL Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "//Count by Action\r\nTrendMicroDeepSecurity\r\n| where DeepSecurityModuleName == \"Web Reputation\"\r\n| summarize Events=count(RequestURL) by Device=DeviceName\r\n| top 5 by Events",
        "size": 3,
        "exportFieldName": "SelectedDeviceAction",
        "exportParameterName": "SelectedDeviceAction",
        "exportDefaultValue": "All",
        "exportToExcelOptions": "visible",
        "title": "Web Reputation Computer Activity",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SimplifiedDeviceAction",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "chartSettings": {
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Web Reputation Computer Activity",
      "styleSettings": {
        "maxWidth": "50"
      }
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-TrendMicroOverview",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}