{ "version": "Notebook/1.0", "items": [ { "type": 1, "content": { "json": "## Important Information Incidents\n---\nGain intelligent insights into the risks to your important financial, legal, HR, and governance information. \nThis workbook lets you monitor your at-risk information to determine when and why incidents occurred, as well as who was involved. \nThese incidents are broken into high, medium, and low risk incidents for each information category." }, "name": "Description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CognniIncidents_CL\n| extend Risk = case(Severity == 3, \"3-High Risk\",\n Severity == 2, \"2-Medium Risk\",\n Severity == 1, \"1-Low Risk\", \"0-No Risk\")\n| summarize Count=count() by Risk\n| where Risk <> \"0-No Risk\"\n| order by Risk desc\n| render barchart", "size": 4, "title": "Total Events", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "_TableName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "Risk" }, "showBorder": true, "sortCriteriaField": "Severity", "sortOrderField": 2, "size": "auto" }, "graphSettings": { "type": 0 }, "chartSettings": { "seriesLabelSettings": [ { "seriesName": "1-Low Risk", "label": "Low Risk", "color": "green" }, { "seriesName": "2-Medium Risk", "label": "Medium Risk", "color": "yellow" }, { "seriesName": "3-High Risk", "label": "High Risk", "color": "redBright" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Severity", "sizeAggregation": "Sum", "legendMetric": "Severity", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Severity", "heatmapPalette": "greenRed" } } }, "name": "Total Events" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Incidents by Category\r\nChoose information type category to show detailed events by information type below " }, "name": "IncidentsByCategory - description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CognniIncidents_CL\r\n| summarize totalEvents =count(), \r\n highRisk =count(Severity==3),\r\n mediumRisk =count(Severity==2), \r\n lowRisk =count(Severity==1), \r\n unknownRisk=count(Severity==0)\r\n by informationType_s\r\n| render barchart", "size": 0, "title": "Incidents by category", "timeContext": { "durationMs": 2592000000 }, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "informationType_s", "parameterName": "informationType_s", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "gridSettings": { "sortBy": [ { "itemKey": "fileCategory_s", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "fileCategory_s", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "informationType_s", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "subtitleContent": { "columnMatch": "totalEvents", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "Out of [\"totalEvents\"] total events", "columnSettings": [ { "columnName": "totalEvents", "color": "blue" } ] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Total Events" } }, "leftContent": { "columnMatch": "highRisk", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "Events by risk level", "columnSettings": [ { "columnName": "highRisk", "color": "redBright" }, { "columnName": "mediumRisk", "color": "yellow" }, { "columnName": "lowRisk", "color": "green" }, { "columnName": "unknownRisk", "color": "blue" } ] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false }, "emptyValCustomText": "Unknown" } }, "showBorder": true, "sortCriteriaField": "totalEvents", "sortOrderField": 2, "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "fileCategory_s", "formatter": 1 }, "leftContent": { "columnMatch": "riskCount", "formatter": 12, "formatOptions": { "palette": "blue" } }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "nodeIdField": "fileCategory_s", "sourceIdField": "fileCategory_s", "targetIdField": "Count", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "xAxis": "fileCategory_s" }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "riskCount", "sizeAggregation": "Sum", "legendMetric": "riskCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "riskCount", "heatmapPalette": "greenRed" } } }, "name": "Incidents by category" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let infoType_ = dynamic([{informationType_s}]);\r\nCognniIncidents_CL\r\n| where informationType_s in (infoType_)\r\n| project TimeGenerated, eventTime_t, informationType_s, userId_s, fileName_s, name_s, labels_s, insights_s, Severity, attachmentId_s, messageId_s", "size": 0, "title": "Incidents by specific category", "timeContext": { "durationMs": 2592000000 }, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "informationType_s", "parameterName": "informationType_s", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "fileName_s", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "fileName_s", "sortOrder": 1 } ], "tileSettings": { "titleContent": { "columnMatch": "informationType_s", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false }, "emptyValCustomText": "Unknown" } }, "subtitleContent": { "columnMatch": "totalEvents", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "Out of [\"totalEvents\"] total events", "columnSettings": [ { "columnName": "totalEvents", "color": "blue" } ] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false } }, "tooltipFormat": { "tooltip": "Total Events" } }, "leftContent": { "columnMatch": "highRisk", "formatter": 22, "formatOptions": { "compositeBarSettings": { "labelText": "Events by risk level", "columnSettings": [ { "columnName": "highRisk", "color": "redBright" }, { "columnName": "mediumRisk", "color": "yellow" }, { "columnName": "lowRisk", "color": "green" }, { "columnName": "unknownRisk", "color": "blue" } ] } }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false }, "emptyValCustomText": "Unknown" } }, "showBorder": true, "sortCriteriaField": "informationType_s", "sortOrderField": 1, "size": "auto" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "fileCategory_s", "formatter": 1 }, "leftContent": { "columnMatch": "riskCount", "formatter": 12, "formatOptions": { "palette": "blue" } }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "nodeIdField": "fileCategory_s", "sourceIdField": "fileCategory_s", "targetIdField": "Count", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "xAxis": "fileCategory_s" }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "riskCount", "sizeAggregation": "Sum", "legendMetric": "riskCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "riskCount", "heatmapPalette": "greenRed" } } }, "conditionalVisibility": { "parameterName": "informationType_s", "comparison": "isNotEqualTo" }, "name": "Incidents by category - Drill down" } ] }, "name": "Incidents by category" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "loadType": "always", "items": [ { "type": 1, "content": { "json": "# Incidents by risk level \r\nChoose risk level to show detailed events by risk level to the right. " }, "name": "IncidentsByRiskLevel-description" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CognniIncidents_CL\n| extend Risk = case(Severity == 1, \"1-Low Risk\",\n Severity == 2, \"2-Medium Risk\",\n Severity == 3, \"3-High Risk\", \"0-No Risk\")\n| summarize Count=count() by Risk\n| where Risk <> \"0-No Risk\"\n| order by Risk desc\n| render barchart", "size": 0, "title": "Incidents by risk level ", "timeContext": { "durationMs": 2592000000 }, "exportMultipleValues": true, "exportedParameters": [ { "fieldName": "Risk", "parameterName": "Risk", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "_TableName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "Risk" }, "showBorder": true, "sortCriteriaField": "Severity", "sortOrderField": 2 }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Severity", "sizeAggregation": "Sum", "legendMetric": "Severity", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Severity", "heatmapPalette": "greenRed" } } }, "customWidth": "17", "name": "Incidents by risk level", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let Risk_ = dynamic([{Risk}]);\nCognniIncidents_CL\n| extend Risk = case(Severity == 1, \"1-Low Risk\",\n Severity == 2, \"2-Medium Risk\",\n Severity == 3, \"3-High Risk\", \"0-No Risk\")\n| where Risk in (Risk_)\n| project TimeGenerated, eventTime_t, Risk, userId_s, fileName_s, name_s, informationType_s, labels_s, insights_s, Severity, attachmentId_s, messageId_s", "size": 0, "title": "Detailed events by Risk level ", "timeContext": { "durationMs": 2592000000 }, "exportFieldName": "Risk", "exportParameterName": "Risk", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "sortBy": [], "tileSettings": { "titleContent": { "columnMatch": "_TableName", "formatter": 1 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "redGreen" }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "useGrouping": false, "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "rightContent": { "columnMatch": "Risk" }, "showBorder": true, "sortCriteriaField": "Severity", "sortOrderField": 2, "size": "auto" }, "graphSettings": { "type": 0 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "Severity", "sizeAggregation": "Sum", "legendMetric": "Severity", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "Severity", "heatmapPalette": "greenRed" } } }, "customWidth": "83", "conditionalVisibility": { "parameterName": "Risk", "comparison": "isNotEqualTo" }, "name": "Drill down - total events", "styleSettings": { "showBorder": true } } ] }, "name": "Total Events with drill down" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CognniIncidents_CL\r\n| summarize totalEvents =count(), \r\n highRisk =count(Severity==3),\r\n mediumRisk =count(Severity==2), \r\n lowRisk =count(Severity==1)\r\n by informationType_s\r\n| render barchart", "size": 1, "title": "Incidents by Category", "timeContext": { "durationMs": 2592000000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "sortBy": [ { "itemKey": "totalEvents", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "totalEvents", "sortOrder": 2 } ], "tileSettings": { "titleContent": { "columnMatch": "fileCategory_s", "formatter": 1, "numberFormat": { "unit": 0, "options": { "style": "decimal", "useGrouping": false }, "emptyValCustomText": "Unknown" } }, "subtitleContent": { "columnMatch": "riskCount" }, "leftContent": { "columnMatch": "highRisk", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "style": "decimal" }, "emptyValCustomText": "Unknown" }, "tooltipFormat": { "tooltip": "Out of {Count} total events" } }, "rightContent": { "columnMatch": "mediumRisk" }, "showBorder": false, "size": "full" }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "fileCategory_s", "formatter": 1 }, "leftContent": { "columnMatch": "riskCount", "formatter": 12, "formatOptions": { "palette": "blue" } }, "centerContent": { "columnMatch": "Count", "formatter": 1, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "nodeIdField": "fileCategory_s", "sourceIdField": "fileCategory_s", "targetIdField": "Count", "graphOrientation": 3, "showOrientationToggles": false, "nodeSize": null, "staticNodeSize": 100, "colorSettings": null, "hivesMargin": 5 }, "chartSettings": { "xAxis": "userId_s" }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "riskCount", "sizeAggregation": "Sum", "legendMetric": "riskCount", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "riskCount", "heatmapPalette": "greenRed" } } }, "name": "Incidents by category" } ], "fromTemplateId": "sentinel-CognniIncidents", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }