{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "9bd917ac-854d-413f-818a-d59721a2a3ac",
            "version": "KqlParameterItem/1.0",
            "name": "IronAPIUrl",
            "type": 1,
            "value": "",
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "ba233765-613b-42da-8262-e7709b5acfed",
            "version": "KqlParameterItem/1.0",
            "name": "IronAPIKey",
            "type": 1,
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 7"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8947c88a-548b-41eb-afa2-f5def502dd7c",
            "version": "KqlParameterItem/1.0",
            "name": "token",
            "type": 1,
            "isGlobal": true,
            "query": "{\"version\":\"CustomEndpoint/1.0\",\"data\":\"{}\",\"headers\":[{\"key\":\"Content-Type\",\"value\":\"application/json\"},{\"key\":\"Authorization\",\"value\":\"Basic {IronAPIKey}\"}],\"method\":\"POST\",\"url\":\"{IronAPIUrl}/IronApi/Login\",\"contentType\":\"application/json\",\"urlParams\":[],\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"token\",\"columns\":[]}}]}",
            "isHiddenWhenLocked": true,
            "queryType": 10,
            "value": null
          },
          {
            "id": "e63ced2c-bdbd-4c36-8c7c-66701725d915",
            "version": "KqlParameterItem/1.0",
            "name": "AlertId",
            "type": 1,
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          },
          {
            "id": "47a9aae0-19b6-417c-8a8a-e5f8db61584e",
            "version": "KqlParameterItem/1.0",
            "name": "RiskScore",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          },
          {
            "id": "f7f2f51e-fd36-460b-b907-350c5500e9e0",
            "version": "KqlParameterItem/1.0",
            "name": "Domain",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          },
          {
            "id": "fc25df27-78e9-4082-8e2f-6ab5886a4b49",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isHiddenWhenLocked": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "value": {
              "durationMs": 7776000000
            }
          },
          {
            "id": "86b16bbf-4f81-47c9-8520-f74207a6be96",
            "version": "KqlParameterItem/1.0",
            "name": "Category",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          },
          {
            "id": "0814f935-9f4c-4db4-aada-dd01c2051412",
            "version": "KqlParameterItem/1.0",
            "name": "Subcategory",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          },
          {
            "id": "44cfba2e-f5f8-40e9-b890-21d01a2e6dad",
            "version": "KqlParameterItem/1.0",
            "name": "IronVueUrl",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          },
          {
            "version": "KqlParameterItem/1.0",
            "name": "Time",
            "type": 1,
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "id": "5265fb7c-9ecd-454b-93d9-41a87e3c6eba",
            "value": ""
          },
          {
            "id": "91d5556f-c021-4d14-b603-87607af0964a",
            "version": "KqlParameterItem/1.0",
            "name": "pr10",
            "type": 1,
            "isHiddenWhenLocked": true,
            "criteriaData": [
              {
                "criteriaContext": {
                  "operator": "Default",
                  "rightValType": "param",
                  "resultValType": "expression",
                  "resultVal": "{token} > 0"
                }
              }
            ]
          },
          {
            "id": "e991e752-07b3-4971-ae88-4301c651acd1",
            "version": "KqlParameterItem/1.0",
            "name": "SourceIP",
            "type": 1,
            "isHiddenWhenLocked": true,
            "value": ""
          }
        ],
        "style": "pills",
        "queryType": 8
      },
      "name": "parameters - 3"
    },
    {
      "type": 1,
      "content": {
        "json": "<h1>Alert ID : {AlertId}</h1>"
      },
      "name": "text - 5"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "217b6954-972d-4acc-9f19-6fbbc1908379",
            "cellValue": "tabchange",
            "linkTarget": "parameter",
            "linkLabel": "Statistics",
            "subTarget": "statistics",
            "style": "link"
          },
          {
            "id": "b2eb7d04-e625-45d7-bbcb-20b38e276edb",
            "cellValue": "tabchange",
            "linkTarget": "parameter",
            "linkLabel": "Details",
            "subTarget": "alertdetails",
            "style": "link"
          },
          {
            "id": "173b4496-7968-4eba-bc25-b50c0ceee129",
            "cellValue": "tabchange",
            "linkTarget": "parameter",
            "linkLabel": "IronDome Notifications",
            "subTarget": "irondome",
            "style": "link"
          }
        ]
      },
      "name": "links - 0"
    },
    {
      "type": 1,
      "content": {
        "json": "\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">{Category} - {Subcategory}</p>"
      },
      "customWidth": "50",
      "name": "text - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "<html>\r\n<body>\r\n<div style=\"padding-left:10px\">\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Risk Score: {RiskScore}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Domains: {Domain}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Traffic Start: {Time}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Traffic End:  {Time}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">IronVueUrl:  {IronVueUrl}</p>\r\n</div>\r\n</body>\r\n</html>"
                        },
                        "customWidth": "50",
                        "name": "text - 0",
                        "styleSettings": {
                          "padding": "20px"
                        }
                      }
                    ]
                  },
                  "name": "layout",
                  "styleSettings": {
                    "showBorder": true
                  }
                }
              ]
            },
            "name": "category group"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "CommonSecurityLog\r\n| where DeviceCustomString4 == '{AlertId}'\r\n| summarize activityCount = count() by LogSeverity, '{SourceIP}',DeviceCustomString4\r\n| project SourceIP='{SourceIP}',activityCount,LogSeverity,DeviceCustomString4",
                    "size": 1,
                    "showAnalytics": true,
                    "title": "Activity By Source IP (Severity vs Source IP)",
                    "noDataMessage": "No Data found",
                    "timeContext": {
                      "durationMs": 7776000000
                    },
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "unstackedbar",
                    "chartSettings": {
                      "xAxis": "SourceIP",
                      "yAxis": [
                        "activityCount"
                      ],
                      "group": "LogSeverity",
                      "createOtherGroup": null,
                      "showMetrics": false,
                      "showLegend": true
                    }
                  },
                  "customWidth": "50",
                  "name": "ActivityStatistic",
                  "styleSettings": {
                    "padding": "20px",
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "CommonSecurityLog\r\n| where DeviceCustomString4 == '{AlertId}' \r\n| summarize eventCount = count() by DeviceCustomString4, TimeGenerated,'{SourceIP}'\r\n| project DeviceCustomString4,eventCount,SourceIP='{SourceIP}',TimeGenerated",
                    "size": 1,
                    "showAnalytics": true,
                    "title": "Events By Source IP (Source IP vs Time)",
                    "noDataMessage": "No Data found",
                    "timeContext": {
                      "durationMs": 7776000000
                    },
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "scatterchart",
                    "chartSettings": {
                      "xAxis": "TimeGenerated",
                      "yAxis": [
                        "eventCount"
                      ],
                      "group": "SourceIP",
                      "createOtherGroup": null,
                      "showMetrics": false,
                      "showLegend": true,
                      "xSettings": {
                        "numberFormatSettings": {
                          "unit": 0,
                          "options": {
                            "style": "decimal",
                            "useGrouping": true
                          }
                        }
                      }
                    }
                  },
                  "customWidth": "50",
                  "name": "query - 2",
                  "styleSettings": {
                    "padding": "20px",
                    "showBorder": true
                  }
                }
              ]
            },
            "name": "charts"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "tabchange",
        "comparison": "isEqualTo",
        "value": "statistics"
      },
      "name": "statisticsgroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "{\"version\":\"CustomEndpoint/1.0\",\"data\":\"{\\\"alert_id\\\":\\\"{AlertId}\\\"}\",\"headers\":[{\"key\":\"Authorization\",\"value\":\"Bearer {token}\"}],\"method\":\"POST\",\"url\":\"{IronAPIUrl}/IronApi/GetEvents\",\"contentType\":\"application/json\",\"urlParams\":[],\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.events[*].session_details[*]\",\"columns\":[]}}]}",
              "size": 0,
              "showAnalytics": true,
              "noDataMessage": "No Data found",
              "queryType": 10,
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "src_entity_id",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "dst_entity_id",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "secondary_app_protocol",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "28ch"
                    }
                  },
                  {
                    "columnMatch": "app_domains",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "total_bytes",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "url",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "src_entity_attribute_type",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "dst_entity_attribute_type",
                    "formatter": 5
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "src_entity_id",
                    "label": ""
                  },
                  {
                    "columnId": "src_ip",
                    "label": "Source IP"
                  },
                  {
                    "columnId": "src_domains",
                    "label": "Source Domains"
                  },
                  {
                    "columnId": "dst_entity_id",
                    "label": ""
                  },
                  {
                    "columnId": "dst_ip",
                    "label": "Destination IP"
                  },
                  {
                    "columnId": "dst_domains",
                    "label": "Destination Domains"
                  },
                  {
                    "columnId": "src_port",
                    "label": "Source Port"
                  },
                  {
                    "columnId": "dst_port",
                    "label": "Destination Port"
                  },
                  {
                    "columnId": "trans_protocol",
                    "label": "Transport Protocol"
                  },
                  {
                    "columnId": "primary_app_protocol",
                    "label": "App Protocol"
                  },
                  {
                    "columnId": "secondary_app_protocol"
                  },
                  {
                    "columnId": "app_domains"
                  },
                  {
                    "columnId": "bytes_in",
                    "label": "Bytes In"
                  },
                  {
                    "columnId": "bytes_out",
                    "label": "Bytes Out"
                  },
                  {
                    "columnId": "total_bytes"
                  },
                  {
                    "columnId": "url"
                  },
                  {
                    "columnId": "src_entity_attribute",
                    "label": "Source Entity"
                  },
                  {
                    "columnId": "src_entity_attribute_type"
                  },
                  {
                    "columnId": "dst_entity_attribute",
                    "label": "Destination Entity"
                  },
                  {
                    "columnId": "dst_entity_attribute_type"
                  },
                  {
                    "columnId": "src_network_id",
                    "label": "Source Network Id"
                  },
                  {
                    "columnId": "dst_network_id",
                    "label": "Destination Network Id"
                  }
                ]
              },
              "sortBy": []
            },
            "conditionalVisibility": {
              "parameterName": "tabchange",
              "comparison": "isEqualTo",
              "value": "alertdetails"
            },
            "name": "Default"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "tabchange",
        "comparison": "isEqualTo",
        "value": "alertdetails"
      },
      "name": "detailsgrp"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "594df1a8-6ffe-4535-a4f6-d366cbd9e13e",
                  "version": "KqlParameterItem/1.0",
                  "name": "irondome",
                  "type": 1,
                  "query": "{\"version\":\"CustomEndpoint/1.0\",\"data\":\"{\\r\\n\\t\\\"alert_id\\\":\\\"{AlertId}\\\"\\r\\n}\",\"headers\":[{\"key\":\"Authorization\",\"value\":\"Bearer {token}\"},{\"key\":\"Content-Type\",\"value\":\"application/json\"}],\"method\":\"POST\",\"url\":\"{IronAPIUrl}/IronApi/GetAlertIronDomeInformation\",\"contentType\":\"application/json\",\"urlParams\":[],\"transformers\":null}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 10
                },
                {
                  "id": "25b71692-08e7-4bc0-a33b-b0d8dd869163",
                  "version": "KqlParameterItem/1.0",
                  "name": "IronDomeCategory",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[0].category\",\"columnid\":\"Category\",\"columnType\":\"string\",\"substringRegexMatch\":\"[\\\\w]{3}_\",\"substringReplace\":\" \"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "f3722cfc-0b49-4773-8706-c9ad38d27a3c",
                  "version": "KqlParameterItem/1.0",
                  "name": "CreatedDate",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[0].created\",\"columnid\":\"CreatedDate\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "0d6884db-0414-4f18-a921-8b17690ea320",
                  "version": "KqlParameterItem/1.0",
                  "name": "Comments",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[0].comment_details\",\"columnid\":\"Comments\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "9060ae37-2371-4ee1-be3a-7e1f56f00733",
                  "version": "KqlParameterItem/1.0",
                  "name": "severity_malicious_details",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*]..severity_malicious_details.ips\",\"columnid\":\"severity_malicious_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "5112d9a4-6982-4152-9981-dcd494557777",
                  "version": "KqlParameterItem/1.0",
                  "name": "joined_high_risk_details",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*].joined_high_risk_details.ips\",\"columnid\":\"joined_high_risk_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "59249b70-76a5-4a1a-bf08-aeb9b5292936",
                  "version": "KqlParameterItem/1.0",
                  "name": "severity_suspicious_details",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*].severity_suspicious_details.ips\",\"columnid\":\"severity_suspicious_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "d8a12e6d-41dd-4f52-97e0-9fbdbb3e085e",
                  "version": "KqlParameterItem/1.0",
                  "name": "severity_malicious_details_domains",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*].severity_malicious_details.domains\",\"columnid\":\"severity_malicious_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "8a84ef96-52fe-4144-a3de-1031d4666f97",
                  "version": "KqlParameterItem/1.0",
                  "name": "joined_high_risk_details_domains",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*].joined_high_risk_details.domains\",\"columnid\":\"joined_high_risk_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "5cb2f5d0-5e49-4f4d-ab78-5cf51b3815aa",
                  "version": "KqlParameterItem/1.0",
                  "name": "severity_suspicious_details_domains",
                  "type": 1,
                  "query": "{\"version\":\"1.0.0\",\"content\":\"{irondome}\",\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"columns\":[{\"path\":\"$.dome_notifications[*].severity_suspicious_details.domains\",\"columnid\":\"severity_suspicious_details\",\"columnType\":\"string\"}]}}]}",
                  "isHiddenWhenLocked": true,
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 8
                },
                {
                  "id": "d42b167f-1c45-4d89-aaa5-89ac254cc9ce",
                  "version": "KqlParameterItem/1.0",
                  "name": "Message",
                  "type": 1,
                  "isHiddenWhenLocked": true,
                  "criteriaData": [
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " PARTICIPANT_ADDED",
                        "resultValType": "static",
                        "resultVal": "An alert was correlated with another alert produced by an IronDome participant."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " COMMENT_ADDED",
                        "resultValType": "param",
                        "resultVal": "Comments"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " COMMUNITY_SEVERITY_CHANGED",
                        "resultValType": "static",
                        "resultVal": "An alert was correlated with another alert that was initially rated as benign/safelisted but was changed to suspicious/malicious."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " COMMUNITY_SEVERITY_MISMATCHED",
                        "resultValType": "static",
                        "resultVal": "An alert rated initially as benign/safelisted was correlated with another alert rated malicious/suspicious by another IronDome participant."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " ENTERPRISE_SEVERITY_MISMATCHED",
                        "resultValType": "static",
                        "resultVal": "An alert rated initially as benign/safelisted was correlated with another alert rated malicious/suspicious in this enterprise."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "static",
                        "resultVal": "Malicious activity was reported in IronDome. A threat intelligence rule has been automatically created in IronDefense."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "static",
                        "resultVal": "An alert was correlated with malicious activity previously reported in IronDome."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "static",
                        "resultVal": "Suspicious activity was reported in IronDome."
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_malicious_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "param",
                        "resultVal": "joined_high_risk_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_suspicious_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_malicious_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "param",
                        "resultVal": "joined_high_risk_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_suspicious_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "operator": "Default",
                        "rightValType": "param",
                        "resultValType": "param",
                        "resultVal": "Comments"
                      }
                    }
                  ],
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "793abf11-10fe-44dd-8d5e-7846c17b2b12",
                  "version": "KqlParameterItem/1.0",
                  "name": "IP",
                  "type": 1,
                  "isHiddenWhenLocked": true,
                  "criteriaData": [
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_malicious_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "param",
                        "resultVal": "joined_high_risk_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_suspicious_details"
                      }
                    },
                    {
                      "criteriaContext": {
                        "operator": "Default",
                        "rightValType": "param",
                        "resultValType": "static",
                        "resultVal": "null"
                      }
                    }
                  ],
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "95a0b4aa-a5fd-4d6b-b57b-2e1b5fde58d0",
                  "version": "KqlParameterItem/1.0",
                  "name": "Domains",
                  "type": 1,
                  "isHiddenWhenLocked": true,
                  "criteriaData": [
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_malicious_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "param",
                        "resultVal": "joined_high_risk_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "param",
                        "resultVal": "severity_suspicious_details_domains"
                      }
                    },
                    {
                      "criteriaContext": {
                        "operator": "Default",
                        "rightValType": "param",
                        "resultValType": "static",
                        "resultVal": "null"
                      }
                    }
                  ],
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "f7418c77-ad35-41bc-a18a-e38b6dcdf3bb",
                  "version": "KqlParameterItem/1.0",
                  "name": "IPStatement",
                  "type": 1,
                  "isHiddenWhenLocked": true,
                  "criteriaData": [
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">IP:  {IP}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">IP:  {IP}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">IP:  {IP}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "operator": "Default",
                        "rightValType": "param",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\"></p>"
                      }
                    }
                  ],
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "12af8d3a-8c49-476e-8e1e-79c9a266b98e",
                  "version": "KqlParameterItem/1.0",
                  "name": "DomainStatement",
                  "type": 1,
                  "isHiddenWhenLocked": true,
                  "criteriaData": [
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_MALICIOUS",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Domains:  {Domains}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " JOINED_HIGH_RISK",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Domains:  {Domains}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "leftOperand": "IronDomeCategory",
                        "operator": "==",
                        "rightValType": "static",
                        "rightVal": " SEVERITY_SUSPICIOUS",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Domains:  {Domains}</p>"
                      }
                    },
                    {
                      "criteriaContext": {
                        "operator": "Default",
                        "rightValType": "param",
                        "resultValType": "static",
                        "resultVal": "<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\"></p>"
                      }
                    }
                  ],
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "pills",
              "queryType": 10
            },
            "name": "parameters - 4"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "<html>\r\n<body>\r\n<div style=\"padding-left:10px\">\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Created Date: {CreatedDate}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Category: {IronDomeCategory}</p>\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">Message: {Message}</p>\r\n{IPStatement}\r\n{DomainStatement}\r\n\r\n</div>\r\n</body>\r\n</html>"
                  },
                  "customWidth": "50",
                  "name": "text - 0",
                  "styleSettings": {
                    "padding": "20px"
                  }
                }
              ]
            },
            "conditionalVisibility": {
              "parameterName": "IronDomeCategory",
              "comparison": "isNotEqualTo"
            },
            "name": "IronDome details",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "<html>\r\n<body>\r\n<div style=\"padding-left:10px\">\r\n<p style=\"font-weight: 600;font-size:14px;font-family: az_ea_font,'Segoe UI',az_font,system-ui,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,'Open Sans','Helvetica Neue',sans-serif;\">No IronDome Notifications found</p>\r\n</div>\r\n</body>\r\n</html>"
                  },
                  "customWidth": "50",
                  "name": "text - 0",
                  "styleSettings": {
                    "padding": "20px"
                  }
                }
              ]
            },
            "conditionalVisibility": {
              "parameterName": "IronDomeCategory",
              "comparison": "isEqualTo"
            },
            "name": "Empty IronDome details",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "tabchange",
        "comparison": "isEqualTo",
        "value": "irondome"
      },
      "name": "IronDome Notification group"
    }
  ],
  "fromTemplateId": "sentinel-IronDefenseAlertDashboard",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}