{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "c1d5c69f-05f2-459b-a6ce-f09fe2c4c1c6",
                  "version": "KqlParameterItem/1.0",
                  "name": "TimeRange",
                  "label": "Time Range",
                  "type": 4,
                  "isRequired": true,
                  "typeSettings": {
                    "selectableValues": [
                      {
                        "durationMs": 300000
                      },
                      {
                        "durationMs": 900000
                      },
                      {
                        "durationMs": 1800000
                      },
                      {
                        "durationMs": 3600000
                      },
                      {
                        "durationMs": 14400000
                      },
                      {
                        "durationMs": 43200000
                      },
                      {
                        "durationMs": 86400000
                      },
                      {
                        "durationMs": 172800000
                      },
                      {
                        "durationMs": 259200000
                      },
                      {
                        "durationMs": 604800000
                      },
                      {
                        "durationMs": 1209600000
                      },
                      {
                        "durationMs": 2419200000
                      },
                      {
                        "durationMs": 2592000000
                      },
                      {
                        "durationMs": 5184000000
                      },
                      {
                        "durationMs": 7776000000
                      }
                    ]
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "value": {
                    "durationMs": 1209600000
                  }
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 0"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"MALWARE\"\r\n| count",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Malware Tags Count",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportParameterName": "Malware",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "auto"
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "25",
                  "name": "query - 1",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"PHISHING\"\r\n| count",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Phishing Tags Count",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportParameterName": "Phishing",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "formatter": 1
                      },
                      "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "auto"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 2,
                            "maximumSignificantDigits": 3
                          }
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "25",
                  "name": "query - 2",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"UNTRUSTWORTHY\"\r\n| count",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Untrustworthy Tags Count",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportParameterName": "Untrustworthy",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "auto"
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "25",
                  "name": "query - 3",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"SPAM\"\r\n| count",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Spam Tags Count",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportParameterName": "Spam",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "auto"
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "25",
                  "name": "query - 4",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on the tiles above to view threat details"
                  },
                  "conditionalVisibilities": [
                    {
                      "parameterName": "Malware",
                      "comparison": "isEqualTo"
                    },
                    {
                      "parameterName": "Phishing",
                      "comparison": "isEqualTo"
                    },
                    {
                      "parameterName": "Untrustworthy",
                      "comparison": "isEqualTo"
                    },
                    {
                      "parameterName": "Spam",
                      "comparison": "isEqualTo"
                    }
                  ],
                  "name": "text - 5"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"MALWARE\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        Tags,\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n        ['Event Time'],\r\n        Attachments,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Type,\r\n        Subtype\r\n        ",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Malware Tags Details",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "conditionalVisibility": {
                    "parameterName": "Malware",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 4",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"PHISHING\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        Tags,\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n        ['Event Time'],\r\n        Attachments,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Type,\r\n        Subtype",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Phishing Tags Details",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "conditionalVisibility": {
                    "parameterName": "Phishing",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 6",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"UNTRUSTWORTHY\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        Tags,\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n         ['Event Time'],\r\n        Attachments,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Type,\r\n        Subtype",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Untrustworthy Tags Details",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "conditionalVisibility": {
                    "parameterName": "Untrustworthy",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 7",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| where Tags contains \"SPAM\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        Tags,\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n         ['Event Time'],\r\n        Attachments,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Type,\r\n        Subtype",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Spam Tags Details",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "conditionalVisibility": {
                    "parameterName": "Spam",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 8",
                  "styleSettings": {
                    "showBorder": true
                  }
                }
              ]
            },
            "name": "group - 22"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| where isnotempty(Direction)\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Direction",
              "size": 0,
              "showAnalytics": true,
              "title": "Email Traffic by Route",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "name": "query - 5",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| parse-kv ['Policies Applied'] as (action: string) with ( kv_delimiter=\":\", pair_delimiter=\",\", quote='\"')\r\n| extend Action = replace_string(trim(@\"\\s\", action),\"_\",\" \")\r\n| where isnotempty(Action)\r\n| summarize count() by Action",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Types of Policy Action",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportFieldName": "series",
                    "exportParameterName": "Action",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "barchart",
                    "chartSettings": {
                      "xAxis": "Action",
                      "yAxis": [
                        "count_"
                      ]
                    }
                  },
                  "name": "query - 6",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on 'Types of Policy Action' bar chart to see 'Policy Mode for Action'"
                  },
                  "conditionalVisibility": {
                    "parameterName": "Action",
                    "comparison": "isEqualTo"
                  },
                  "name": "text - 1"
                }
              ],
              "exportParameters": true
            },
            "name": "group - 17"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| parse-kv ['Policies Applied'] as (action: string, mode: string) with ( kv_delimiter=\":\", pair_delimiter=\",\", quote='\"')\r\n| extend Action = replace_string(trim(@\"\\s\", action),\"_\",\" \"), Mode = replace_string(trim(@\"\\s\", mode),\"_\",\" \")\r\n| where Action == '{Action}' and isnotempty(Mode)\r\n| summarize count() by Mode",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Policy Mode for Action : {Action}",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportFieldName": "series",
                    "exportParameterName": "Mode",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "group": "Mode",
                      "createOtherGroup": 10,
                      "showMetrics": false,
                      "showLegend": true
                    }
                  },
                  "customWidth": "50",
                  "conditionalVisibility": {
                    "parameterName": "Action",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 7",
                  "styleSettings": {
                    "padding": "69px",
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on 'Policy Mode for Action: {Action}' pie chart to see 'Details of Emails for Policy Mode and Policy Action'"
                  },
                  "conditionalVisibilities": [
                    {
                      "parameterName": "Mode",
                      "comparison": "isEqualTo"
                    },
                    {
                      "parameterName": "Action",
                      "comparison": "isNotEqualTo"
                    }
                  ],
                  "name": "text - 1"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| parse-kv ['Policies Applied'] as (action: string, mode: string) with ( kv_delimiter=\":\", pair_delimiter=\",\", quote='\"')\r\n| extend Action = replace_string(trim(@\"\\s\", action),\"_\",\" \"), Mode = replace_string(trim(@\"\\s\", mode),\"_\",\" \")\r\n| where Action == '{Action}' and Mode == '{Mode}'\r\n| extend ['Threat Type'] = replace_string(['Threat Type'],\"_\",\" \"), ['Threat State'] = replace_string(['Threat State'],\"_\",\" \")\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| project Sender, Recipients, Subject, ['Threat State'], ['Threat Type']",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Details of Emails for Policy Mode: {Mode} and Policy Action: {Action}",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "customWidth": "50",
                  "conditionalVisibilities": [
                    {
                      "parameterName": "Action",
                      "comparison": "isNotEqualTo"
                    },
                    {
                      "parameterName": "Mode",
                      "comparison": "isNotEqualTo"
                    }
                  ],
                  "name": "query - 19",
                  "styleSettings": {
                    "showBorder": true
                  }
                }
              ],
              "exportParameters": true
            },
            "name": "group - 21"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| extend ['Threat Type'] = replace_string(trim(@\"\\s\", ['Threat Type']),\"_\",\" \")\r\n| where isnotempty(['Threat Type'])\r\n| summarize count() by ['Threat Type']",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Threat Detection",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportFieldName": "series",
                    "exportParameterName": "ThreatType",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "barchart"
                  },
                  "name": "query - 8",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on 'Threat Detection' bar chart to see 'Threat State for Type'"
                  },
                  "conditionalVisibility": {
                    "parameterName": "ThreatType",
                    "comparison": "isEqualTo"
                  },
                  "name": "text - 1"
                }
              ],
              "exportParameters": true
            },
            "name": "group - 18"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| extend ['Threat Type'] = replace_string(trim(@\"\\s\", ['Threat Type']),\"_\",\" \"),\r\n         ['Threat State'] = replace_string(trim(@\"\\s\", ['Threat State']),\"_\",\" \")\r\n| where ['Threat Type'] == '{ThreatType}' and isnotempty(['Threat State'])\r\n| summarize count() by ['Threat State']",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Threat State for Type: {ThreatType}",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportFieldName": "series",
                    "exportParameterName": "ThreatState",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "showMetrics": false,
                      "showLegend": true
                    }
                  },
                  "customWidth": "50",
                  "conditionalVisibility": {
                    "parameterName": "ThreatType",
                    "comparison": "isNotEqualTo"
                  },
                  "name": "query - 9",
                  "styleSettings": {
                    "padding": "69px",
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on 'Threat State for Type: {ThreatType}' pie chart to see 'Details of Emails for Threat State and Threat Type'"
                  },
                  "conditionalVisibilities": [
                    {
                      "parameterName": "ThreatState",
                      "comparison": "isEqualTo"
                    },
                    {
                      "parameterName": "ThreatType",
                      "comparison": "isNotEqualTo"
                    }
                  ],
                  "name": "text - 1"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| extend ['Threat Type'] = replace_string(trim(@\"\\s\", ['Threat Type']),\"_\",\" \"),\r\n         ['Threat State'] = replace_string(trim(@\"\\s\", ['Threat State']),\"_\",\" \")\r\n| where ['Threat Type'] == '{ThreatType}' and ['Threat State'] == '{ThreatState}'\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| project Sender, Recipients, Subject, ['Threat State'], ['Threat Type']",
                    "size": 0,
                    "showAnalytics": true,
                    "title": "Details of Emails for Threat State: {ThreatState} and Threat Type: {ThreatType}",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "rowLimit": 10000,
                      "filter": true
                    }
                  },
                  "customWidth": "50",
                  "conditionalVisibilities": [
                    {
                      "parameterName": "ThreatType",
                      "comparison": "isNotEqualTo"
                    },
                    {
                      "parameterName": "ThreatState",
                      "comparison": "isNotEqualTo"
                    }
                  ],
                  "name": "query - 18",
                  "styleSettings": {
                    "showBorder": true
                  }
                }
              ],
              "exportParameters": true
            },
            "name": "group - 20"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| extend senderGeoDetails = geo_info_from_ip_address(['Sender IP'])\r\n| extend latitude = senderGeoDetails.latitude, longitude = senderGeoDetails.longitude, country = senderGeoDetails.country, state = senderGeoDetails.state, city = senderGeoDetails.city\r\n| where isnotempty(latitude) and isnotempty(longitude)\r\n| extend label = strcat(\r\n    iif(strlen(city) > 0, strcat(city, \", \"), \"\"),\r\n    iif(strlen(state) > 0, strcat(state, \", \"), \"\"),\r\n    country\r\n)\r\n| extend label = trim(\", \", label)\r\n| extend label = iif(strlen(label) > 0, label, \"N/A\")\r\n| summarize  count() by tostring(latitude), tostring(longitude), label",
              "size": 3,
              "showAnalytics": true,
              "title": "Messages Sent by Country",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "map",
              "mapSettings": {
                "locInfo": "LatLong",
                "latitude": "latitude",
                "longitude": "longitude",
                "sizeSettings": "count_",
                "sizeAggregation": "Sum",
                "labelSettings": "label",
                "legendMetric": "count_",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "nodeColorField": "count_",
                  "colorAggregation": "Sum",
                  "type": "heatmap",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "name": "query - 15",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| where Direction == \"INBOUND\"\r\n| extend details = geo_info_from_ip_address(['Sender IP'])\r\n| extend Country = trim(@\"\\s\", tostring(details.country))\r\n| where isnotempty(Country)\r\n| summarize count() by Country\r\n| top 10 by count_  ",
              "size": 3,
              "showAnalytics": true,
              "title": "Top 10 Inbound Email Detections by Origin",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "group": "Country",
                "createOtherGroup": 10,
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "50",
            "name": "query - 10",
            "styleSettings": {
              "padding": "49px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| extend Domain = tostring(split(['Sender Envelope'],\"@\")[1])\r\n| where isnotempty(Domain)\r\n| summarize count() by Domain\r\n| top 10 by count_",
              "size": 3,
              "showAnalytics": true,
              "title": "Top 10 Sender Domains",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "group": "Domain",
                "createOtherGroup": 10,
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "50",
            "name": "query - 11",
            "styleSettings": {
              "padding": "49px",
              "showBorder": true
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastCloudIntegrated\r\n| extend Subtype = replace_string(trim(@\"\\s\", Subtype),\"_\",\" \")\r\n| where isnotempty(Subtype)\r\n| summarize count() by Subtype\r\n",
                    "size": 3,
                    "showAnalytics": true,
                    "title": "Threat Sub Types",
                    "timeContextFromParameter": "TimeRange",
                    "showRefreshButton": true,
                    "exportFieldName": "series",
                    "exportParameterName": "Subtype",
                    "showExportToExcel": true,
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "showMetrics": false,
                      "showLegend": true
                    }
                  },
                  "customWidth": "100",
                  "name": "query - 12",
                  "styleSettings": {
                    "padding": "49px",
                    "showBorder": true
                  }
                },
                {
                  "type": 1,
                  "content": {
                    "json": "💡 Click on 'Threat Sub Types' pie chart to see 'Details of Emails for Sub Type'"
                  },
                  "conditionalVisibility": {
                    "parameterName": "Subtype",
                    "comparison": "isEqualTo"
                  },
                  "name": "text - 1"
                }
              ],
              "exportParameters": true
            },
            "customWidth": "50",
            "name": "group - 19"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| where ['Sender Envelope'] contains \"@\"\r\n| summarize count() by ['Sender Envelope']\r\n| top 10 by count_",
              "size": 3,
              "showAnalytics": true,
              "title": "Top 10 Senders",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "group": "Sender Envelope",
                "createOtherGroup": 10,
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "50",
            "name": "query - 13",
            "styleSettings": {
              "padding": "49px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| extend ['Threat Type'] = replace_string(['Threat Type'],\"_\",\" \"),\r\n         ['Threat State'] = replace_string(['Threat State'],\"_\",\" \"),\r\n         Subtype = replace_string(trim(@\"\\s\", Subtype),\"_\",\" \")\r\n| where Subtype == '{Subtype}'\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| project Sender, Recipients, Subject, ['Threat State'], ['Threat Type']",
              "size": 0,
              "showAnalytics": true,
              "title": "Details of Emails for Sub Type: {Subtype}",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true
              }
            },
            "conditionalVisibility": {
              "parameterName": "Subtype",
              "comparison": "isNotEqualTo"
            },
            "name": "query - 17",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| extend recipients = todynamic(Recipients)\r\n| mv-expand recipients\r\n| where recipients contains \"@\"\r\n| summarize count() by tostring(recipients)\r\n| top 10 by count_",
              "size": 3,
              "showAnalytics": true,
              "title": "Top 10 Receivers",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "group": "recipients",
                "createOtherGroup": 10,
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "50",
            "name": "query - 14",
            "styleSettings": {
              "padding": "49px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| where Type == \"urlclick\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        [\"Event Time\"],\r\n        Attachments,\r\n        Tags,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Type,\r\n        Subtype",
              "size": 0,
              "showAnalytics": true,
              "title": "Url Protect Overview",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 20",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastCloudIntegrated\r\n| where Type == \"entities\"\r\n| project-rename Sender = ['Sender Envelope']\r\n| extend Recipients = replace_string(Recipients,'\"','') \r\n| extend Recipients = replace_string(Recipients,',',', ') \r\n| extend  Recipients = trim(@\"[\\[\\]]\",Recipients)\r\n| extend Tags = replace_string(Tags,'\"','') \r\n| extend Tags = replace_string(Tags,',',', ') \r\n| extend  Tags = trim(@\"[\\[\\]]\",Tags)\r\n| extend Attachments = replace_string(Attachments,'\"','') \r\n| extend Attachments = replace_string(Attachments,',',', ') \r\n|extend  Attachments = trim(@\"[\\[\\]]\",Attachments)\r\n| extend  ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\r\n| project    Type, Sender,\r\n        ['Sender IP'],\r\n        Recipients,\r\n        ['Threat State'],\r\n        ['Threat Type'],\r\n        ['Policies Applied'],\r\n        ['Account ID'],\r\n        ['Aggregate ID'],\r\n        ['Processing ID'],\r\n        ['Message ID'],\r\n        [\"Event Time\"],\r\n        Attachments,\r\n        Tags,\r\n        Subject,\r\n        Source,\r\n        Direction,\r\n        ['Sender Header'],\r\n        ['Historical Mail'],\r\n        Subtype",
              "size": 0,
              "showAnalytics": true,
              "title": "Entities Overview",
              "timeContextFromParameter": "TimeRange",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 20 - Copy",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 1,
            "content": {
              "json": "📝 ***Refresh the web page to fetch details of recently collected events***"
            },
            "name": "text - 16"
          }
        ]
      },
      "name": "group - 0"
    }
  ],
  "fromTemplateId": "Sentinel-Mimecast-Cloud-Integrated-Workbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}