{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "b8d3205b-b903-4db7-8c7a-f82bacd94242",
                        "version": "KqlParameterItem/1.0",
                        "name": "bhe_tenant",
                        "label": "BHE Tenant",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEAuditLogsData_CL\n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "752a2195-64fc-402e-b80f-c7c4fb9b49bd",
                        "version": "KqlParameterItem/1.0",
                        "name": "event_type",
                        "label": "Event Type",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEAuditLogsData_CL\n| where isnotempty(action)\n| where tenant_url in~ ({bhe_tenant})\n| distinct action",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "5de91703-b999-47c1-98e3-648bb4724abf",
                        "version": "KqlParameterItem/1.0",
                        "name": "actor_name",
                        "label": "Actor name",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEAuditLogsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where action in~ ({event_type})\n| distinct actor_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "705413e9-2968-4485-975f-a782991db8df",
                        "version": "KqlParameterItem/1.0",
                        "name": "time",
                        "label": "Time Range Picker",
                        "type": 4,
                        "isRequired": true,
                        "typeSettings": {
                            "selectableValues": [
                                {
                                    "durationMs": 300000
                                },
                                {
                                    "durationMs": 900000
                                },
                                {
                                    "durationMs": 1800000
                                },
                                {
                                    "durationMs": 3600000
                                },
                                {
                                    "durationMs": 14400000
                                },
                                {
                                    "durationMs": 43200000
                                },
                                {
                                    "durationMs": 86400000
                                },
                                {
                                    "durationMs": 172800000
                                },
                                {
                                    "durationMs": 259200000
                                },
                                {
                                    "durationMs": 604800000
                                },
                                {
                                    "durationMs": 1209600000
                                },
                                {
                                    "durationMs": 2419200000
                                },
                                {
                                    "durationMs": 2592000000
                                },
                                {
                                    "durationMs": 5184000000
                                },
                                {
                                    "durationMs": 7776000000
                                }
                            ]
                        },
                        "value": {
                            "durationMs": 604800000
                        },
                        "key": "705413e9-2968-4485-975f-a782991db8df"
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEAuditLogsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where action in~ ({event_type})\n| where actor_name in~ ({actor_name})\n| where created_at {time}\n| summarize arg_max(created_at, *) by created_at\n| project-away _ResourceId, created_at1\n| order by TimeGenerated desc\n| project [\"Created At\"] = created_at, \n            [\"Ingestion Time\"] = IngestionTime,\n            Id = id,\n            [\"Actor Id\"] = actor_id,\n            [\"Actor Name\"] = actor_name,\n            [\"Action\"] = action,\n            [\"Fields\"] = fields,\n            [\"Request Id\"] = request_id,\n            [\"Source IP Address\"] = source_ip_address,\n            [\"Status\"] = status,\n            [\"Commit Id\"] = commit_id,\n            [\"Tenant URL\"] = tenant_url,\n            [\"Tenant ID\"] = TenantId,\n            [\"Type\"] = Type\n\n\n\n\n",
                "size": 3,
                "timeContextFromParameter": "time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "sortBy": []
            },
            "name": "query - 2"
        }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-BloodHoundEnterprise",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}