{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "**NOTE**: This workbook depends on a parser based on Kusto Function to work as expected [**GCP_IAM**](https://aka.ms/sentinel-GCPIAMDataConnector-parser) which is deployed with the Microsoft Sentinel Solution."
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "c462d04c-c285-4d4b-afd6-1be6c5232374",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "value": {
              "durationMs": 7776000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "GCP_IAM_CL\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
              "size": 3,
              "title": "Events over time",
              "timeContext": {
                "durationMs": 7776000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "linechart"
            },
            "customWidth": "55",
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "GCP_IAM_CL\r\n| project EventSeverity = severity_s\r\n| where isnotempty(EventSeverity)\r\n| summarize count() by EventSeverity",
              "size": 3,
              "title": "Events by Severity",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "25",
            "name": "query - 3"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "GCP_IAM_CL\r\n| project User=column_ifexists('payload_authenticationInfo_principalEmail_s', '')\r\n| where isnotempty(User)\r\n| summarize Users = dcount(User)",
                    "size": 3,
                    "title": "Total Users",
                    "timeContext": {
                      "durationMs": 0
                    },
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "card",
                    "textSettings": {
                      "style": "bignumber"
                    }
                  },
                  "name": "query - 0"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "GCP_IAM_CL\r\n| project ServiceAccount=column_ifexists('payload_request_service_account_display_name_s', '')\r\n| where isnotempty(ServiceAccount)\r\n| summarize SvcAccount = dcount(ServiceAccount)",
                    "size": 3,
                    "title": "Total Service accounts",
                    "timeContext": {
                      "durationMs": 0
                    },
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "card",
                    "textSettings": {
                      "style": "bignumber"
                    }
                  },
                  "name": "query - 1"
                }
              ]
            },
            "customWidth": "20",
            "name": "group - 2"
          }
        ]
      },
      "name": "group - 5"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "GCP_IAM_CL\r\n| project ResourceName=column_ifexists('payload_resourceName_s', '')\r\n| where notempty(ResourceName)\r\n| summarize count() by ResourceName\r\n| top 5 by count_",
              "size": 3,
              "title": "Top Resources",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "40",
            "name": "query - 4"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "GCP_IAM_CL\r\n| project ServiceAccount=column_ifexists('payload_request_service_account_display_name_s', '')\r\n| where isnotempty(ServiceAccount)\r\n| summarize count() by ServiceAccount",
              "size": 3,
              "title": "Top Service accounts",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "55",
            "name": "query - 4"
          }
        ]
      },
      "name": "group - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "GCP_IAM_CL\r\n| extend result = parse_json(todynamic(column_ifexists('payload_authorizationInfo_s', '')))[0]['granted']\r\n| project EventEndTime=timestamp_t, SrcIpAddr=payload_requestMetadata_callerIp_s, User=column_ifexists('payload_authenticationInfo_principalEmail_s', ''), Action=column_ifexists('payload_methodName_s', ''), EventResult=iff(result == 'true', '✔️ Success', '❌ Failed')\r\n| sort by EventEndTime desc\r\n",
        "size": 0,
        "title": "Latest actions",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true
        }
      },
      "name": "query - 0"
    }
  ],
  "fromTemplateId": "sentinel-GCP-IAM-Workbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}