{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "content": {
                "json": "**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**McAfeeEPOEvent**](https://aka.ms/sentinel-McAfeeePO-parser) which is deployed with the Microsoft Sentinel Solution."
            },
            "name": "text - 2"
        },
        {
            "type": 11,
            "content": {
                "version": "LinkItem/1.0",
                "style": "tabs",
                "links": [
                    {
                        "id": "24d0a087-55d0-4205-b17f-59866e20d7d4",
                        "cellValue": "Tab",
                        "linkTarget": "parameter",
                        "linkLabel": "Event Overview",
                        "subTarget": "ma_events",
                        "style": "link"
                    },
                    {
                        "id": "b8caadb4-a5ef-4e30-9611-45fd2ac1fa46",
                        "cellValue": "Tab",
                        "linkTarget": "parameter",
                        "linkLabel": "Threats",
                        "subTarget": "ma_threats",
                        "style": "link"
                    }
                ]
            },
            "customWidth": "100",
            "name": "links - 2"
        },
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "3b79a6c4-43ca-48f8-8010-18ab3056bec3",
                        "version": "KqlParameterItem/1.0",
                        "name": "TimeRange",
                        "label": "Time Range",
                        "type": 4,
                        "value": {
                            "durationMs": 604800000
                        },
                        "typeSettings": {
                            "selectableValues": [
                                {
                                    "durationMs": 900000
                                },
                                {
                                    "durationMs": 3600000
                                },
                                {
                                    "durationMs": 43200000
                                },
                                {
                                    "durationMs": 604800000
                                },
                                {
                                    "durationMs": 2592000000
                                },
                                {
                                    "durationMs": 7776000000
                                }
                            ]
                        },
                        "timeContext": {
                            "durationMs": 86400000
                        }
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "100",
            "name": "parameters - 3",
            "styleSettings": {
                "margin": "0"
            }
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
                "size": 0,
                "title": "Events Over Time",
                "color": "turquoise",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart",
                "chartSettings": {
                    "showMetrics": false
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "45",
            "name": "query - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| summarize Count = count() by EventSeverity\r\n| join kind = inner (McAfeeEPOEvent\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventSeverity)\r\n on EventSeverity",
                "size": 3,
                "title": "Event Distribution by Severity",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "tiles",
                "tileSettings": {
                    "titleContent": {
                        "columnMatch": "EventSeverity",
                        "formatter": 1
                    },
                    "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                            "palette": "auto"
                        },
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "style": "decimal",
                                "useGrouping": false,
                                "maximumFractionDigits": 2,
                                "maximumSignificantDigits": 3
                            }
                        }
                    },
                    "secondaryContent": {
                        "columnMatch": "Trend",
                        "formatter": 10,
                        "formatOptions": {
                            "palette": "purpleDark"
                        }
                    },
                    "showBorder": false
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "30",
            "name": "query - 6"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| summarize TotalEvents = count() by EventSeverity",
                "size": 3,
                "title": "EventSeverity Distribution",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "piechart",
                "chartSettings": {
                    "showMetrics": false
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "25",
            "name": "query - 8"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| summarize TotalEvents = count() by DvcIpAddr\r\n| top 10 by TotalEvents\r\n",
                "size": 0,
                "title": "Top 10 Sources",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "barchart"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "33",
            "name": "query - 5"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(SrcDvcOs)\r\n| summarize TotalEvents = count() by SrcDvcOs\r\n| top 10 by TotalEvents",
                "size": 3,
                "title": "Events Distribution by OS",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "piechart"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "33",
            "name": "query - 7"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(AgentVersion)\r\n| summarize Agents = dcount(DvcIpAddr) by AgentVersion",
                "size": 0,
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_events"
            },
            "customWidth": "33",
            "name": "query - 4"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(ThreatName)\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
                "size": 0,
                "title": "Threats over Time",
                "color": "redBright",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "50",
            "name": "query - 9"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| summarize Count = count() by ThreatCategory\r\n| join kind = inner (McAfeeEPOEvent\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatCategory)\r\n on ThreatCategory",
                "size": 0,
                "title": "Threats by Category",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "tiles",
                "tileSettings": {
                    "titleContent": {
                        "columnMatch": "ThreatCategory",
                        "formatter": 1
                    },
                    "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                            "palette": "auto"
                        },
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "maximumSignificantDigits": 3,
                                "maximumFractionDigits": 2
                            }
                        }
                    },
                    "secondaryContent": {
                        "columnMatch": "Trend",
                        "formatter": 9,
                        "formatOptions": {
                            "palette": "redDark"
                        }
                    },
                    "showBorder": false
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "50",
            "name": "query - 10"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(ThreatName)\r\n| where ThreatName != '_'\r\n| summarize TotalEvents = count() by ThreatName\r\n| order by TotalEvents desc\r\n| top 10 by TotalEvents\r\n",
                "size": 0,
                "title": "Top 10 Threats",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "categoricalbar"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "60",
            "name": "query - 11"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(ThreatName)\r\n| where ThreatName != '_'\r\n| summarize TotalEvents = count() by ThreatName\r\n| sort by TotalEvents desc\r\n",
                "size": 0,
                "title": "Top Threats",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "gridSettings": {
                    "rowLimit": 50,
                    "filter": true
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "40",
            "name": "query - 12"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(ThreatName)\r\n| where ThreatName != '_'\r\n| order by TimeGenerated desc\r\n| summarize EventTime = max(TimeGenerated) by ThreatName, DvcIpAddr",
                "size": 0,
                "title": "Latest Threats by Source",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "gridSettings": {
                    "rowLimit": 50,
                    "filter": true
                }
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "40",
            "name": "query - 13"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(AnalyzerRuleName)\r\n| summarize TotalEvents = count() by AnalyzerRuleName\r\n",
                "size": 3,
                "title": "Rules Fired",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "piechart"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "25",
            "name": "query - 14"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "McAfeeEPOEvent\r\n| where isnotempty(AnalyzerRuleName)\r\n| order by TimeGenerated\r\n| summarize by AnalyzerRuleName, DvcIpAddr",
                "size": 0,
                "title": "Latest Rules Fired",
                "timeContext": {
                    "durationMs": 604800000
                },
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "conditionalVisibility": {
                "parameterName": "Tab",
                "comparison": "isEqualTo",
                "value": "ma_threats"
            },
            "customWidth": "33",
            "name": "query - 15"
        }
    ],
    "fromTemplateId": "sentinel-McAfeeePO",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}