{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "257a73ba-2a77-4dbe-b769-e18f3dbe05ce",
            "version": "KqlParameterItem/1.0",
            "name": "TimeGenrated",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| where eventName in (\"ListAccessKeys\", \"GetAccountSummary\", \"GetPasswordPolicy\", \"GetAccountMFAInfo\")\n| summarize EventCount = count() by eventName\n| order by EventCount desc\n",
        "size": 4,
        "title": "High-Risk API Calls (Security Sensitive)",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "eventName",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "EventCount",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": true
        }
      },
      "name": "High-Risk API Calls (Security Sensitive)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| summarize EventCount = count() by serviceName\n| order by EventCount desc\n",
        "size": 4,
        "title": "Events by AliCloud Service Name",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "33",
      "name": "Events by AliCloud Service Name"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| extend MFAStatus = tostring(parse_json(userIdentity.sessionContext.attributes).mfaAuthenticated)\n| summarize EventCount = count() by MFAStatus\n",
        "size": 4,
        "title": "Accounts Without MFA",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "33",
      "name": "Accounts Without MFA"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| extend userType = tostring(userIdentity.type)\n| summarize EventCount = count() by userType\n",
        "size": 4,
        "title": "Root vs Assumed Role Usage",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "33",
      "name": "Root vs Assumed Role Usage"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| summarize EventCount = count() by sourceIpAddress\n| order by EventCount desc\n",
        "size": 0,
        "title": "Unusual Source IPs Accessing AliCloud",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Unusual Source IPs Accessing AliCloud"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| summarize EventCount = count() by eventName\n| order by EventCount desc\n",
        "size": 0,
        "timeContextFromParameter": "TimeGenrated",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| summarize EventCount = count() by eventSource\n| order by EventCount desc\n",
        "size": 0,
        "title": "Top Event Sources in AliCloud",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top Event Sources in AliCloud"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| where tostring(userIdentity.type) == \"root-account\"\n| summarize EventCount = count() by bin(eventTime, 1h), eventName\n| order by eventTime asc\n",
        "size": 0,
        "title": "Root Account Actions Over Time",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "Root Account Actions Over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| summarize EventCount = count() by bin(eventTime, 1h)\n| order by eventTime asc\n",
        "size": 0,
        "title": "API Call Trends (Potential Attack Timeline)",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "API Call Trends (Potential Attack Timeline)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AliCloud\n| where eventName == \"ListAccessKeys\"\n| summarize EventCount = count() by bin(eventTime, 1h)\n| order by eventTime asc\n",
        "size": 0,
        "title": "ListAccessKeys Event Spike Detection",
        "timeContextFromParameter": "TimeGenrated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "name": "ListAccessKeys Event Spike Detection"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-AliCloudWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}