{
  "version": "Notebook/1.0",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
  "fromTemplateId": "sentinel-StratoSecure-APIInventory",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## StratoSecure — API Risk Inventory\n\nUnified view of all discovered API endpoints — active, shadow, zombie, and dormant — with security risk classification."
      },
      "name": "header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "timeRange",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "value": {"durationMs": 2592000000}
          }
        ]
      },
      "name": "parameters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_ApiInventory_CL\n| where TimeGenerated {TimeRange}\n| summarize count() by Status\n| order by count_ desc",
        "size": 1,
        "title": "API Status Distribution",
        "queryType": 0,
        "visualization": "piechart"
      },
      "name": "statusDistribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_ApiInventory_CL\n| where TimeGenerated {TimeRange}\n| where AuthType == 'none' and InternetExposure == true\n| project Path, Method, ServiceName, DataClassification, TimeGenerated\n| order by TimeGenerated desc",
        "size": 1,
        "title": "Unauthenticated Internet-facing APIs",
        "queryType": 0,
        "visualization": "table"
      },
      "name": "unauthInternet"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_ApiInventory_CL\n| where TimeGenerated >= ago(7d)\n| where IsNew == true or DiscoverySource has 'new'\n| project Path, Method, ServiceName, DiscoverySource, TimeGenerated\n| order by TimeGenerated desc",
        "size": 1,
        "title": "New APIs (Last 7 Days)",
        "queryType": 0,
        "visualization": "table"
      },
      "name": "newApis"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_ApiInventory_CL\n| where TimeGenerated {TimeRange}\n| where DataClassification in ('PCI', 'PHI', 'PII')\n| summarize count() by DataClassification, AuthType\n| order by count_ desc",
        "size": 1,
        "title": "Sensitive Data Exposure by Auth Type",
        "queryType": 0,
        "visualization": "barchart"
      },
      "name": "sensitiveData"
    }
  ],
  "fallbackResourceIds": []
}