{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "84513d7a-7856-4e1d-81cb-47ac72d832cb",
            "version": "KqlParameterItem/1.0",
            "name": "Time",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "d19d1b63-079c-45c0-98b8-f93d21843187",
            "version": "KqlParameterItem/1.0",
            "name": "ChangeType",
            "label": " Change Type",
            "type": 2,
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "jsonData": "[\r\n    {\"value\":\"Add\", \"label\":\"Create\"},\r\n    {\"value\":\"Delete\", \"label\":\"Delete\"},    \r\n    {\"value\":\"Modify\", \"label\":\"Modify\"},    \r\n    {\"value\":\"Move\", \"label\":\"Move\"}\r\n]",
            "timeContext": {
              "durationMs": 86400000
            },
            "value": null
          },
          {
            "id": "8cf1ac5d-6b31-4ed9-9e88-313b36db2ae7",
            "version": "KqlParameterItem/1.0",
            "name": "Class",
            "type": 1,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          },
          {
            "id": "eb342abf-cde4-4fdd-88f5-932fc719561e",
            "version": "KqlParameterItem/1.0",
            "name": "AttributeName",
            "label": "Attribute Name",
            "type": 1,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          },
          {
            "id": "7e694221-97c0-43a6-acae-8a143a407e3c",
            "version": "KqlParameterItem/1.0",
            "name": "ObjectChanged",
            "label": "Object Changed",
            "type": 1,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog \r\n| where DeviceEventClassID == 'Semperis.DSP.AdChanges'\r\n| extend p1Array = split(AdditionalExtensions,\";\")\r\n| mv-expand bagexpansion=array p1Array\r\n| evaluate bag_unpack(p1Array)\r\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\r\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\r\n| parse column_ifexists('DistinguishedName', '') with * \"CN\\\\=\" cnName \",\" *\r\n| extend OriginatingTime=column_ifexists('OriginatingTime', '')\r\n| extend AttributeModificationType=column_ifexists('AttributeModificationType', '')\r\n| extend ClassName=column_ifexists('ClassName', '')\r\n| extend AttributeName=column_ifexists('AttributeName', '')\r\n| where isempty('{Time}') or (todatetime(OriginatingTime) >= todatetime('{Time:startISO}') and todatetime(OriginatingTime) <= todatetime('{Time:endISO}'))\r\n| where isempty('{ChangeType}') or (iif('{ChangeType}' == \"Delete\",indexof(AttributeModificationType,'{ChangeType}') > -1 or indexof(AttributeModificationType,'Remove') > -1,indexof(AttributeModificationType,'{ChangeType}') > -1))\r\n| where isempty('{Class}') or indexof(ClassName,'{Class}') > -1\r\n| where isempty('{AttributeName}') or indexof(AttributeName,'{AttributeName}') > -1\r\n| where isempty('{ObjectChanged}') or indexof(cnName,'{ObjectChanged}') > -1\r\n| project OriginatingTime, AttributeModificationType, AttributeName, cnName, ClassName, column_ifexists('DistinguishedName', ''), column_ifexists('LinkedValueDN', ''), column_ifexists('ObjectModificationType', ''),column_ifexists('OriginatingServer', ''),column_ifexists('OriginatingUserWorkstations', ''),column_ifexists('OriginatingUsers', ''),column_ifexists('PartitionNamingContext', ''),column_ifexists('StringValueFrom', ''),column_ifexists('StringValueTo', '')",
        "size": 0,
        "title": "Semperis DSP AD Change",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "labelSettings": [
            {
              "columnId": "OriginatingTime",
              "label": "Originating Time"
            },
            {
              "columnId": "AttributeModificationType",
              "label": "Change Type"
            },
            {
              "columnId": "AttributeName",
              "label": "Attribute Name"
            },
            {
              "columnId": "cnName",
              "label": "CN"
            },
            {
              "columnId": "ClassName",
              "label": "Class"
            },
            {
              "columnId": "DistinguishedName",
              "label": "DN"
            },
            {
              "columnId": "LinkedValueDN",
              "label": "Linked Value DN"
            },
            {
              "columnId": "ObjectModificationType",
              "label": "Object Modification Type"
            },
            {
              "columnId": "OriginatingServer",
              "label": "Originating Server"
            },
            {
              "columnId": "OriginatingUserWorkstations",
              "label": "Originating Workstation"
            },
            {
              "columnId": "OriginatingUsers",
              "label": "Originating Identity"
            },
            {
              "columnId": "PartitionNamingContext",
              "label": "Partition"
            },
            {
              "columnId": "StringValueFrom",
              "label": "Value From"
            },
            {
              "columnId": "StringValueTo",
              "label": "Value To"
            }
          ]
        }
      },
      "name": "query - 1"
    }
  ],
  "fromTemplateId": "sentinel-SemperisDSPADChanges",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}