{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## Island Enterprise Browser Admin Audit Overview"
        },
        "name": "text - 0"
      },
      {
        "type": 9,
        "content": {
          "version": "KqlParameterItem/1.0",
          "parameters": [
            {
              "id": "e246fdd8-f37f-4290-a205-7ffa192ea860",
              "version": "KqlParameterItem/1.0",
              "name": "TimeRange",
              "type": 4,
              "isRequired": true,
              "value": {
                "durationMs": 604800000
              },
              "typeSettings": {
                "selectableValues": [
                  {
                    "durationMs": 300000
                  },
                  {
                    "durationMs": 900000
                  },
                  {
                    "durationMs": 1800000
                  },
                  {
                    "durationMs": 3600000
                  },
                  {
                    "durationMs": 14400000
                  },
                  {
                    "durationMs": 43200000
                  },
                  {
                    "durationMs": 86400000
                  },
                  {
                    "durationMs": 172800000
                  },
                  {
                    "durationMs": 259200000
                  },
                  {
                    "durationMs": 604800000
                  },
                  {
                    "durationMs": 1209600000
                  },
                  {
                    "durationMs": 2419200000
                  },
                  {
                    "durationMs": 2592000000
                  },
                  {
                    "durationMs": 5184000000
                  },
                  {
                    "durationMs": 7776000000
                  }
                ],
                "allowCustom": true
              }
            },
            {
              "id": "4fae5ad4-351d-46f7-b4b4-f20cdf540a9f",
              "version": "KqlParameterItem/1.0",
              "name": "Admin",
              "type": 2,
              "description": "Select an Admin or Admins to filter on",
              "isRequired": true,
              "multiSelect": true,
              "quote": "'",
              "delimiter": ",",
              "query": "Island_Admin_CL\n| distinct email_s\n| project Value = email_s",
              "typeSettings": {
                "additionalResourceOptions": [
                  "value::all"
                ],
                "selectAllValue": "All",
                "showDefault": false
              },
              "timeContext": {
                "durationMs": 1209600000
              },
              "timeContextFromParameter": "TimeRange",
              "defaultValue": "value::all",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "value": [
                "value::all"
              ]
            }
          ],
          "style": "pills",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "parameters - 1"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Island_Admin_CL\r\n| where email_s !=\"\"\r\n| where (email_s in ({Admin}) or '{Admin:label}' == \"All\")\r\n| summarize Count = count() by email_s\r\n| order by Count desc",
          "size": 0,
          "title": "Top Admins by Email",
          "timeContextFromParameter": "TimeRange",
          "exportFieldName": "DestinationServiceName",
          "exportParameterName": "DestinationServiceNameFilter",
          "exportDefaultValue": "All",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "Count",
                "formatter": 4,
                "formatOptions": {
                  "min": 0,
                  "palette": "purple",
                  "showIcon": true
                }
              }
            ],
            "filter": true
          }
        },
        "customWidth": "50",
        "name": "query - 3"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Island_Admin_CL\r\n| where actionDomain_s  !=\"\"\r\n| where (email_s in ({Admin}) or '{Admin:label}' == \"All\")\r\n| summarize Count = count() by actionDomain_s\r\n| order by Count desc",
          "size": 3,
          "title": "Top Action Domains",
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "50",
        "name": "query - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Island_Admin_CL\n| where actionType_s  !=\"\"\n| where (email_s in ({Admin}) or '{Admin:label}' == \"All\")\n| summarize Count = count() by actionType_s\n| order by Count desc",
          "size": 3,
          "title": "Top Action Types",
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "50",
        "name": "query - 12"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "Island_Admin_CL\r\n| where entityType_s == \"RuleEntity\"\r\n| where entityName_s  !=\"\"\r\n| where (email_s in ({Admin}) or '{Admin:label}' == \"All\")\r\n| summarize Count = count() by entityName_s\r\n| order by Count desc",
          "size": 3,
          "title": "Top Rules Administered",
          "timeContextFromParameter": "TimeRange",
          "exportFieldName": "Location",
          "exportParameterName": "LocationFilter",
          "exportDefaultValue": "All",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "Downloads",
                "formatter": 4,
                "formatOptions": {
                  "min": 0,
                  "palette": "blue",
                  "showIcon": true
                }
              },
              {
                "columnMatch": "Uploads",
                "formatter": 4,
                "formatOptions": {
                  "palette": "green",
                  "showIcon": true
                }
              }
            ]
          }
        },
        "customWidth": "50",
        "name": "query - 6"
      }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }