{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Filter Parameters",
        "expandable": true,
        "expanded": true,
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "6fae20b1-4c99-4444-8eec-118d49bc4819",
                  "version": "KqlParameterItem/1.0",
                  "name": "TimeRange",
                  "label": "Time Range",
                  "type": 4,
                  "description": "Time Range for Data",
                  "isGlobal": true,
                  "typeSettings": {
                    "selectableValues": [
                      {
                        "durationMs": 300000
                      },
                      {
                        "durationMs": 900000
                      },
                      {
                        "durationMs": 1800000
                      },
                      {
                        "durationMs": 3600000
                      },
                      {
                        "durationMs": 14400000
                      },
                      {
                        "durationMs": 43200000
                      },
                      {
                        "durationMs": 86400000
                      },
                      {
                        "durationMs": 172800000
                      },
                      {
                        "durationMs": 259200000
                      },
                      {
                        "durationMs": 604800000
                      },
                      {
                        "durationMs": 1209600000
                      },
                      {
                        "durationMs": 2419200000
                      },
                      {
                        "durationMs": 2592000000
                      },
                      {
                        "durationMs": 5184000000
                      },
                      {
                        "durationMs": 7776000000
                      }
                    ],
                    "allowCustom": true
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "value": {
                    "durationMs": 2592000000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "15",
            "name": "parameters - 6"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "45b60e04-fd60-4b68-b7cd-0ac60bc96671",
                  "version": "KqlParameterItem/1.0",
                  "name": "LogAnalyticsWorkspace",
                  "label": "Log Analytics Workspace",
                  "type": 5,
                  "description": "Source Log Analytics Workspace",
                  "isGlobal": true,
                  "query": "resources | where type =~ 'Microsoft.operationsmanagement/solutions' | where name contains 'SecurityInsights' | project id = tostring(properties.workspaceResourceId)",
                  "typeSettings": {
                    "resourceTypeFilter": {
                      "microsoft.operationalinsights/workspaces": true,
                      "microsoft.desktopvirtualization/workspaces": true,
                      "microsoft.apicenter/services/workspaces": true,
                      "microsoft.apimanagement/service/workspaces": true
                    },
                    "showDefault": false
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 1,
                  "resourceType": "microsoft.resourcegraph/resources",
                  "value": null
                }
              ],
              "style": "above",
              "queryType": 1,
              "resourceType": "microsoft.resourcegraph/resources"
            },
            "customWidth": "15",
            "name": "parameters - 5"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "f6a66069-738a-4664-92db-3b25da9ba906",
                  "version": "KqlParameterItem/1.0",
                  "name": "SelectedTab",
                  "type": 1,
                  "isGlobal": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "value": "alert_severity"
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "20",
            "conditionalVisibility": {
              "parameterName": "PurdueLevel",
              "comparison": "isEqualTo",
              "value": "abcd"
            },
            "name": "parameters - 19"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "4f25575d-17c9-4896-8bec-7a85d96e39eb",
                  "version": "KqlParameterItem/1.0",
                  "name": "AssetIpAddress",
                  "label": "Asset Ip Address",
                  "type": 1,
                  "description": "IP Address of Asset to view",
                  "isRequired": true,
                  "isGlobal": true,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "15",
            "name": "parameters - 2"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "f200aaf5-8fc4-4e21-b8d9-0308e8302d85",
                  "version": "KqlParameterItem/1.0",
                  "name": "PurdueLevel",
                  "label": "Purdue Level",
                  "type": 1,
                  "description": "Value of Purdue Level to view Assets",
                  "isRequired": true,
                  "isGlobal": true,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "15",
            "name": "parameters - 8"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "2958962e-027c-4c66-8341-d3e9dd019c97",
                  "version": "KqlParameterItem/1.0",
                  "name": "AssetSeverity",
                  "label": "Asset Severity",
                  "type": 1,
                  "description": "Value of Severity to view Assets",
                  "isRequired": true,
                  "isGlobal": true,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "20",
            "name": "parameters - 5"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "8834a3bc-8099-41ed-8d02-6c6e1a640b9d",
                  "version": "KqlParameterItem/1.0",
                  "name": "AlertSeverity",
                  "label": "Alert Severity",
                  "type": 1,
                  "description": "Value of Severity to view Alerts",
                  "isRequired": true,
                  "isGlobal": true,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "20",
            "name": "parameters - 7"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "2aaad873-997a-496b-a824-21cb3e62f0f6",
                  "version": "KqlParameterItem/1.0",
                  "name": "CCIP",
                  "label": "Command Center IP",
                  "type": 2,
                  "description": "IP Address of Command Center",
                  "isGlobal": true,
                  "query": "datatable(CommandCenterIpAddr:string) [\"Any\"]\r\n| union (\r\n    union ForescoutOtAsset_CL, ForescoutOtAlert_CL\r\n    | where isnotempty(CommandCenterIpAddr)\r\n    | distinct CommandCenterIpAddr\r\n)",
                  "typeSettings": {
                    "showDefault": false
                  },
                  "timeContext": {
                    "durationMs": 0
                  },
                  "timeContextFromParameter": "TimeRange",
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": "Any"
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 7"
          }
        ],
        "exportParameters": true
      },
      "name": "Filter Parameters",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Number of Assets/Alerts/Sensors",
        "expandable": true,
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAsset_CL\r\n| sort by TimeGenerated\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| summarize distinctAssets =  count() by IpAddr\r\n| summarize Number_Of_Distinct_Assets = count()\r\n| project Number_Of_Distinct_Assets",
              "size": 4,
              "title": "        Number of Assets",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "visualization": "tiles",
              "gridSettings": {
                "rowLimit": 100
              },
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Number_Of_Distinct_Assets",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto",
                    "compositeBarSettings": {
                      "labelText": ""
                    }
                  }
                },
                "showBorder": false,
                "size": "auto"
              },
              "statSettings": {
                "valueAggregation": "None",
                "colorSettings": {
                  "type": "static",
                  "mode": "foreground",
                  "staticColor": "blue",
                  "heatmapPalette": "greenRed"
                },
                "iconSettings": {
                },
                "tagText": "",
                "valueFontStyle": "medium"
              }
            },
            "customWidth": "20",
            "name": "query - 8"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| sort by TimeGenerated\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n//| summarize distinctAssets =  count() by IpAddr\r\n|  summarize Number_Of_New_Alerts = count()\r\n| project Number_Of_New_Alerts",
              "size": 4,
              "title": "Number of Alerts",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Number_Of_New_Alerts",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false
              },
              "statSettings": {
                "valueAggregation": "None",
                "colorSettings": {
                  "type": "static",
                  "mode": "foreground",
                  "staticColor": "blue",
                  "heatmapPalette": "greenRed"
                },
                "iconSettings": {
                },
                "tagText": "",
                "valueFontStyle": "medium"
              }
            },
            "customWidth": "20",
            "name": "query - 9"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(SensorName)\r\n| distinct tostring(SensorName)\r\n|summarize Number_of_Sensors = count()",
              "size": 4,
              "title": "Number of Sensors",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Number_of_Sensors",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false
              },
              "statSettings": {
                "valueAggregation": "None",
                "colorSettings": {
                  "type": "static",
                  "mode": "foreground",
                  "staticColor": "blue",
                  "heatmapPalette": "greenRed"
                },
                "iconSettings": {
                },
                "tagText": "",
                "valueFontStyle": "medium"
              }
            },
            "customWidth": "20",
            "name": "query - 10"
          }
        ]
      },
      "name": "Summary Counts",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Assets Information",
        "expandable": true,
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAsset_CL\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(PurdueLevel)\r\n| where isnotempty(IpAddr)\r\n| distinct IpAddr, tostring(PurdueLevel)\r\n| summarize Count = count() by tostring(PurdueLevel)\r\n| sort by tostring(PurdueLevel) asc\r\n| project PurdueLevel, Count \r\n| render barchart",
              "size": 0,
              "title": "Assets Per Purdue",
              "timeContextFromParameter": "TimeRange",
              "exportFieldName": "x",
              "exportParameterName": "PurdueLevel",
              "exportDefaultValue": "",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "visualization": "categoricalbar"
            },
            "customWidth": "65",
            "name": "query - 11",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n//| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(SrcIpAddr)\r\n| where isnotempty(Severity)\r\n| distinct SrcIpAddr, tostring(Severity)\r\n| summarize Count = count() by SrcIpAddr, tostring(Severity)\r\n| sort by tostring(Severity) asc\r\n| project Severity, Count \r\n| render piechart",
              "size": 0,
              "title": "Assets Per Severity",
              "timeContextFromParameter": "TimeRange",
              "exportFieldName": "series",
              "exportParameterName": "AssetSeverity",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "High",
                    "color": "redBright"
                  },
                  {
                    "seriesName": "Medium",
                    "color": "purple"
                  },
                  {
                    "seriesName": "Low",
                    "color": "turquoise"
                  }
                ]
              }
            },
            "customWidth": "35",
            "name": "query - 12",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "Assets Information"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Alerts Information",
        "expandable": true,
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL \r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| sort by TimeGenerated\r\n//| take 10000\r\n| summarize count() by bin(TimeGenerated, 6h), tostring(Severity)\r\n| render areachart",
              "size": 0,
              "title": "Alerts Over Time",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "customWidth": "65",
            "name": "query - 13",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(Severity)\r\n| summarize Count = count() by tostring(Severity)\r\n| project Severity, Count\r\n| render piechart",
              "size": 0,
              "title": "Alerts Per Severity",
              "timeContextFromParameter": "TimeRange",
              "exportFieldName": "series",
              "exportParameterName": "AlertSeverity",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ],
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "color": "turquoise"
                  },
                  {
                    "seriesName": "High",
                    "color": "redBright"
                  },
                  {
                    "seriesName": "Medium",
                    "color": "purple"
                  },
                  {
                    "seriesName": "Informational",
                    "color": "magenta"
                  }
                ]
              }
            },
            "customWidth": "35",
            "name": "query - 14",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n|summarize NumberOfAlerts = count() by tostring(SrcIpAddr)//, tostring(DstIpAddr)\r\n|sort by NumberOfAlerts\r\n| take 10\r\n|render barchart",
              "size": 0,
              "title": "Top 10 Assets with most Alerts",
              "timeContextFromParameter": "TimeRange",
              "exportFieldName": "x",
              "exportParameterName": "AssetIpAddress",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "customWidth": "65",
            "name": "query - 15",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where SensorName <> \"\"\r\n| summarize Count = count() by tostring(SensorName)\r\n| project SensorName, Count\r\n| render piechart",
              "size": 0,
              "title": "Alerts per Sensor",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "customWidth": "35",
            "name": "query - 13",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "Alerts Information"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Details",
        "expandable": true,
        "items": [
          {
            "type": 11,
            "content": {
              "version": "LinkItem/1.0",
              "style": "tabs",
              "links": [
                {
                  "id": "2dfe478b-1a64-4f53-86de-51854f57501c",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Assets",
                  "subTarget": "assets",
                  "style": "link"
                },
                {
                  "id": "da0873be-6caa-4529-8cdf-0ae30d2f8c24",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Alerts",
                  "subTarget": "alerts",
                  "style": "link"
                },
                {
                  "id": "f2648211-33f3-459c-9e03-8c6ba845d546",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Selected Asset Details",
                  "subTarget": "asset_single",
                  "style": "link"
                },
                {
                  "id": "3dd7e7d4-4017-4881-84b8-c63714d25c3b",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Assets by Purdue",
                  "subTarget": "asset_purdue",
                  "style": "link"
                },
                {
                  "id": "043cb8ea-841b-46a3-8448-e71e9f5244b3",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Assets by Severity",
                  "subTarget": "asset_severity",
                  "style": "link"
                },
                {
                  "id": "c87b5aa1-1bad-4d93-9a77-0adeb969badf",
                  "cellValue": "SelectedTab",
                  "linkTarget": "parameter",
                  "linkLabel": "Alerts by Severity",
                  "subTarget": "alert_severity",
                  "style": "link"
                }
              ]
            },
            "name": "links - 10"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAsset_CL\r\n| where TimeGenerated between ({TimeRange:start} .. {TimeRange:end})\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n|sort by TimeGenerated  \r\n| extend first_seen_epoch = todatetime(tostring(FirstSeen))\r\n| extend Duration = now() - first_seen_epoch\r\n| extend SrcIpAddr = IpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Critical\" | summarize CriticalCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"High\" | summarize HighCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Medium\" | summarize MediumCount = count() by SrcIpAddr) on SrcIpAddr\r\n|summarize by IpAddr, CommandCenterIpAddr, tostring(MacAddrs), CriticalCount, HighCount, MediumCount, tostring(FirstSeen), tostring(MainVendorModel), tostring(FirmwareVersion), tostring(HardwareVersion), tostring(SerialNumber), tostring(Labels), tostring(OsVersion), tostring(MainRole), Duration\r\n| distinct Duration, IpAddr, CommandCenterIpAddr, MacAddrs, CriticalCount, HighCount, MediumCount, MainRole, MainVendorModel, FirmwareVersion, HardwareVersion, SerialNumber, Labels, OsVersion, FirstSeen\r\n| project-rename ['Ip Address']=IpAddr, ['CommandCenter Ip Address']=CommandCenterIpAddr, ['MAC']=MacAddrs, ['Critical #']=CriticalCount, ['High #']=HighCount, ['Medium #']=MediumCount, ['Main Role']=MainRole, ['Main Vendor Model']=MainVendorModel, ['Firmware Version']=FirmwareVersion, ['Hardware Version']=HardwareVersion, ['Serial Number']=SerialNumber, ['OS Version']=OsVersion, ['First Seen'] = FirstSeen\r\n|render table",
              "size": 0,
              "title": "Assets",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "customWidth": "100",
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "assets"
            },
            "name": "query - 16",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(Severity)\r\n| project TimeGenerated, AlertId, Severity, AlertCategory, Status, SrcIpAddr, SrcMacAddr, DstIpAddr, DstMacAddr, CommandCenterIpAddr, SensorName, CaseId, AlertData, Desc, SrcHostName, DstHostName, SrcPort, DstPort, L2Proto, L3Proto, L4Proto, L7Proto, Labels, MitreTactics, Name, ProfId, ProfModName, EngineName, TypeId\r\n| project-rename ['Time Generated']=TimeGenerated, ['Alert Id']=AlertId, Severity, Status, ['Src IpAddress']=SrcIpAddr, ['Src MAC']=SrcMacAddr, ['Dst IpAddress']=DstIpAddr, ['Dst MAC']=DstMacAddr, ['Command Center IpAddr']=CommandCenterIpAddr, ['Sensor Name']=SensorName, ['Alert Category']=AlertCategory, ['Case Id']=CaseId, ['Alert Data']=AlertData, Desc, ['Src HostName']=SrcHostName, ['Dst HostName']=DstHostName, ['Src Port']=SrcPort, ['Dst Port']=DstPort, ['L2 Protocol']=L2Proto, ['L3 Protocol']=L3Proto, ['L4 Protocol']=L4Proto, ['L7 Protocol']=L7Proto, Labels, ['Mitre Tactics']=MitreTactics, Name, ['Prof Id']=ProfId, ['Prof Module']=ProfModName, ['Engine Name']=EngineName, ['Type Id']=TypeId\r\n| render table",
              "size": 0,
              "title": "Alerts",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "customWidth": "100",
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "alerts"
            },
            "name": "query - 3",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAsset_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n|sort by TimeGenerated\r\n| where isnotempty(IpAddr)\r\n| where IpAddr == '{AssetIpAddress}'\r\n| extend SrcIpAddr = IpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Critical\" | summarize CriticalCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"High\" | summarize HighCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Medium\" | summarize MediumCount = count() by SrcIpAddr) on SrcIpAddr\r\n| summarize arg_max (TimeGenerated,CommandCenterIpAddr, tostring(MacAddrs),CriticalCount, HighCount, MediumCount, MainRole, MainVendorModel, FirmwareVersion, HardwareVersion, SerialNumber, Labels, OsVersion, FirstSeen, LastSeen, AssetData) by IpAddr\r\n| project-rename ['Ip Address']=IpAddr, ['CommandCenter Ip Address']=CommandCenterIpAddr, ['MAC']=MacAddrs, ['Critical #']=CriticalCount, ['High #']=HighCount, ['Medium #']=MediumCount, ['Main Role']=MainRole, ['Main Vendor Model']=MainVendorModel, ['Firmware Version']=FirmwareVersion, ['Hardware Version']=HardwareVersion, ['Serial Number']=SerialNumber, ['OS Version']=OsVersion, ['First Seen'] = FirstSeen",
              "size": 0,
              "title": "Asset details of IP {AssetIpAddress}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "asset_single"
            },
            "name": "query - 11"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAsset_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| sort by TimeGenerated\r\n| where isnotempty(PurdueLevel)\r\n//| extend selectedPurdueLevel = iff(isnotempty({PurdueLevel}), '{PurdueLevel}', 'notset')\r\n| where PurdueLevel == '{PurdueLevel}'\r\n//| distinct IpAddr, tostring(PurdueLevel)\r\n//| project IpAddr, PurdueLevel\r\n//| distinct IpAddr, tostring(PurdueLevel)\r\n| extend SrcIpAddr = IpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Critical\" | summarize CriticalCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"High\" | summarize HighCount = count() by SrcIpAddr) on SrcIpAddr\r\n| lookup kind=leftouter (ForescoutOtAlert_CL | where Severity == \"Medium\" | summarize MediumCount = count() by SrcIpAddr) on SrcIpAddr\r\n| summarize arg_max (TimeGenerated, CommandCenterIpAddr, tostring(MacAddrs),CriticalCount, HighCount, MediumCount, MainRole, MainVendorModel, FirmwareVersion, HardwareVersion, SerialNumber, Labels, OsVersion, FirstSeen, LastSeen, AssetData) by IpAddr\r\n| project-rename ['Ip Address']=IpAddr, ['Time Generated']=TimeGenerated, ['Command Center Ip Address']=CommandCenterIpAddr, ['MAC']=MacAddrs, ['Critical #']=CriticalCount, ['High #']=HighCount, ['Medium #']=MediumCount, ['Main Role']=MainRole, ['Main Vendor Model']=MainVendorModel, ['Firmware Version']=FirmwareVersion, ['Hardware Version']=HardwareVersion, ['Serial Number']=SerialNumber, ['OS Version']=OsVersion, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen, ['Asset Data']=AssetData \r\n| render table",
              "size": 0,
              "title": "Assets matching PurdueLevel {PurdueLevel}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "asset_purdue"
            },
            "name": "query - 12"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where Severity == '{AssetSeverity}'\r\n| where isnotempty(SrcIpAddr)\r\n| extend IpAddr = SrcIpAddr\r\n| distinct SrcIpAddr,  SrcMacAddr, IpAddr\r\n| lookup ForescoutOtAsset_CL on IpAddr | summarize arg_max (TimeGenerated, CommandCenterIpAddr, tostring(MacAddrs), MainRole, MainVendorModel, FirmwareVersion, HardwareVersion, SerialNumber, Labels, OsVersion, FirstSeen, LastSeen, AssetData) by IpAddr | project-rename ['Ip Address']=IpAddr, ['Time Generated']=TimeGenerated, ['Command Center Ip Address']=CommandCenterIpAddr, ['MAC']=MacAddrs, ['Main Role']=MainRole, ['Main Vendor Model']=MainVendorModel, ['Firmware Version']=FirmwareVersion, ['Hardware Version']=HardwareVersion, ['Serial Number']=SerialNumber, ['OS Version']=OsVersion, ['First Seen']=FirstSeen, ['Last Seen']=LastSeen, ['Asset Data']=AssetData \r\n| render table",
              "size": 0,
              "title": "Assets with Severity - {AssetSeverity}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "asset_severity"
            },
            "name": "query - 13"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ForescoutOtAlert_CL\r\n| where iff((isnull('{CCIP}') or isempty('{CCIP}') or ('{CCIP}' == \"Any\")), true, CommandCenterIpAddr == '{CCIP}')\r\n| where isnotempty(Severity)\r\n| where Severity == '{AlertSeverity}'\r\n| project TimeGenerated, AlertId, Severity, Status, SrcIpAddr, SrcMacAddr, DstIpAddr, DstMacAddr, CommandCenterIpAddr, SensorName, AlertCategory, CaseId, AlertData, Desc, SrcHostName, DstHostName, SrcPort, DstPort, L2Proto, L3Proto, L4Proto, L7Proto, Labels, MitreTactics, Name, ProfId, ProfModName, EngineName, TypeId\r\n| project-rename ['Time Generated']=TimeGenerated, ['Alert Id']=AlertId, Severity, Status, ['Src IpAddress']=SrcIpAddr, ['Src MAC']=SrcMacAddr, ['Dst IpAddress']=DstIpAddr, ['Dst MAC']=DstMacAddr, ['Command Center IpAddr']=CommandCenterIpAddr, ['Sensor Name']=SensorName, ['Alert Category']=AlertCategory, ['Case Id']=CaseId, ['Alert Data']=AlertData, Desc, ['Src HostName']=SrcHostName, ['Dst HostName']=DstHostName, ['Src Port']=SrcPort, ['Dst Port']=DstPort, ['L2 Protocol']=L2Proto, ['L3 Protocol']=L3Proto, ['L4 Protocol']=L4Proto, ['L7 Protocol']=L7Proto, Labels, ['Mitre Tactics']=MitreTactics, Name, ['Prof Id']=ProfId, ['Prof Module']=ProfModName, ['Engine Name']=EngineName, ['Type Id']=TypeId\r\n| render table",
              "size": 0,
              "title": "Alerts by Severity - {AlertSeverity}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticsWorkspace}"
              ]
            },
            "conditionalVisibility": {
              "parameterName": "SelectedTab",
              "comparison": "isEqualTo",
              "value": "alert_severity"
            },
            "name": "query - 14"
          }
        ],
        "exportParameters": true
      },
      "name": "Details",
      "styleSettings": {
        "showBorder": true
      }
    }
  ],
  "styleSettings": {
    "spacingStyle": "none"
  },
  "fromTemplateId": "sentinel-eyeInspectOTSecurityWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}