{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## Eset Security Management Center"
        },
        "name": "text - 2"
      },
      {
        "type": 9,
        "content": {
          "version": "KqlParameterItem/1.0",
          "parameters": [
            {
              "id": "c84a31aa-79fc-45f8-8991-8b56e0545a8c",
              "version": "KqlParameterItem/1.0",
              "name": "TimeRange",
              "type": 4,
              "isRequired": true,
              "value": {
                "durationMs": 259200000
              },
              "typeSettings": {
                "selectableValues": [
                  {
                    "durationMs": 3600000
                  },
                  {
                    "durationMs": 14400000
                  },
                  {
                    "durationMs": 43200000
                  },
                  {
                    "durationMs": 86400000
                  },
                  {
                    "durationMs": 172800000
                  },
                  {
                    "durationMs": 259200000
                  },
                  {
                    "durationMs": 604800000
                  },
                  {
                    "durationMs": 1209600000
                  },
                  {
                    "durationMs": 2419200000
                  },
                  {
                    "durationMs": 2592000000
                  },
                  {
                    "durationMs": 5184000000
                  },
                  {
                    "durationMs": 7776000000
                  }
                ],
                "allowCustom": true
              },
              "timeContext": {
                "durationMs": 86400000
              }
            }
          ],
          "style": "pills",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "parameters - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| summarize events_count = count() by event_type_s, bin(TimeGenerated, {TimeRange:grain})",
          "size": 0,
          "title": "Events",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "barchart"
        },
        "customWidth": "50",
        "name": "allEventsOverTIme"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == \"Threat_Event\"\r\n| summarize events_count = count() by threat_name_s, bin(TimeGenerated, {TimeRange:grain})",
          "size": 0,
          "title": "Threats",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "barchart"
        },
        "customWidth": "50",
        "name": "queryThreatsOverTime"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == 'Threat_Event'\r\n| summarize events_count = count() by threat_name_s",
          "size": 3,
          "title": "Top threats",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart",
          "tileSettings": {
            "showBorder": false,
            "titleContent": {
              "columnMatch": "threat_name_s",
              "formatter": 1
            },
            "leftContent": {
              "columnMatch": "events_count",
              "formatter": 12,
              "formatOptions": {
                "palette": "auto"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "maximumSignificantDigits": 3,
                  "maximumFractionDigits": 2
                }
              }
            }
          }
        },
        "customWidth": "33",
        "name": "queryTopThreats"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == 'Threat_Event'\r\n| summarize events_count = count() by threat_type_s",
          "size": 3,
          "title": "Top threats by type",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "33",
        "name": "queryTopThreatsByType"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == 'Threat_Event'\r\n| summarize events_count = count() by hostname_s",
          "size": 3,
          "title": "Most attacked hosts",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "33",
        "name": "queryMostAttackedHosts"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == 'Threat_Event'\r\n| summarize events_count = count() by username_s",
          "size": 3,
          "title": "Most attacked users",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "33",
        "name": "queryMostAttackedUsers"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == \"FirewallAggregated_Event\"\r\n| summarize count() by source_address_s",
          "size": 3,
          "title": "Top remote attackers",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "33",
        "name": "queryTopRemoteAttackers"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == \"FilteredWebsites_Event\"\r\n| where action_taken_s == \"blocked\"\r\n| summarize count() by object_uri_s",
          "size": 3,
          "title": "Most blocked sites",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart"
        },
        "customWidth": "33",
        "name": "queryMostBlockedSites"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "eset_CL\r\n| where TimeGenerated {TimeRange}\r\n| where event_type_s == \"Threat_Event\"\r\n| project TimeGenerated, hostname_s, username_s, threat_type_s, threat_name_s, processname_s, action_taken_s\r\n| sort by TimeGenerated desc",
          "size": 0,
          "showAnalytics": true,
          "title": "Latest threats",
          "showExportToExcel": true,
          "exportToExcelOptions": "all",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "rowLimit": 1000,
            "filter": true
          }
        },
        "name": "queryLatestThreats"
      }
    ],
    "fallbackResourceIds": [
      ""
    ],
    "fromTemplateId": "sentinel-EsetSMC",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }