{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8ccaabbc-2531-4a3a-a4d1-22890e77fe7e",
            "version": "KqlParameterItem/1.0",
            "name": "time_range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 1209600000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 6"
    },
    {
      "type": 1,
      "content": {
        "json": "# Mail Receipt Events"
      },
      "name": "text - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "## Receipt Events by Mimecast Event Id",
        "style": "info"
      },
      "name": "text - 25"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)",
        "size": 3,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "mail_receipt_received",
              "label": "Received"
            },
            {
              "seriesName": "mail_receipt_virus",
              "label": "Viruses"
            },
            {
              "seriesName": "mail_receipt_received_notls",
              "label": "Non-TLS"
            },
            {
              "seriesName": "mail_receipt_rejected",
              "label": "Rejected"
            },
            {
              "seriesName": "mail_receipt_spam",
              "label": "Spam"
            }
          ]
        }
      },
      "name": "query - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "## Rejection Types",
        "style": "info"
      },
      "name": "text - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s == \"mail_receipt_rejected\" and RejType_s !=\"\"\n| summarize count() by RejType_s , bin(TimeGenerated, 1h)",
        "size": 3,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "RejType_s",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": true,
          "size": "auto"
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "RejType_s",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "nodeIdField": "RejType_s",
          "sourceIdField": "TimeGenerated",
          "targetIdField": "count_",
          "graphOrientation": 1,
          "showOrientationToggles": false,
          "nodeSize": null,
          "staticNodeSize": 100,
          "colorSettings": null,
          "hivesMargin": 5
        },
        "chartSettings": {
          "createOtherGroup": 0
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "count_",
          "sizeAggregation": "Sum",
          "legendMetric": "count_",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "count_",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "name": "query - 14"
    },
    {
      "type": 1,
      "content": {
        "json": "## Rejections - Spam",
        "style": "info"
      },
      "name": "text - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s==\"mail_receipt_spam\"\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, SpamScore_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "sortBy": [
            {
              "itemKey": "SpamScore_s",
              "sortOrder": 1
            }
          ]
        },
        "sortBy": [
          {
            "itemKey": "SpamScore_s",
            "sortOrder": 1
          }
        ],
        "chartSettings": {
          "createOtherGroup": 0,
          "seriesLabelSettings": [
            {
              "seriesName": "mail_receipt_spam",
              "label": "Spam"
            }
          ]
        }
      },
      "name": "query - 14"
    },
    {
      "type": 1,
      "content": {
        "json": "## Rejections - Malware",
        "style": "info"
      },
      "name": "text - 15"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"receipt\" and mimecastEventId_s == \"mail_receipt_virus\" and RejType_s != \"\"\n| summarize count() by Sender_s, headerFrom_s, Rcpt_s, IP_s, Subject_s, RejInfo_s, Virus_s, Error_s, bin(TimeGenerated, 1h)",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Sender_s",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "mapSettings": {
          "locInfo": "AzureResource",
          "locInfoColumn": "Error_s",
          "sizeAggregation": "Count",
          "legendMetric": "count_",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "nodeColorField": "count_",
            "colorAggregation": "Sum",
            "type": "thresholds",
            "thresholdsGrid": [
              {
                "operator": "Default",
                "thresholdValue": null,
                "representation": "blue"
              }
            ]
          }
        }
      },
      "name": "query - 16"
    },
    {
      "type": 1,
      "content": {
        "json": "# Mail Process Events",
        "style": "info"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"process\"\n| summarize dcount=count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)",
        "size": 3,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "mail_process_accepted",
              "label": "Accepted",
              "color": "green"
            },
            {
              "seriesName": "mail_process_held",
              "label": "Held",
              "color": "brown"
            },
            {
              "seriesName": "mail_process_sandboxed",
              "label": "Sandboxed",
              "color": "turquoise"
            },
            {
              "seriesName": "mail_process_retried",
              "label": "Retries",
              "color": "pink"
            }
          ]
        }
      },
      "name": "query - 3"
    },
    {
      "type": 1,
      "content": {
        "json": "## Held Messages",
        "style": "info"
      },
      "name": "text - 18"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"process\"  and Hld_s != \"\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Hld_s, Sender_s, Subject_s, AttSize_s, AttCnt_s, AttNames_s, MsgSize_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 17"
    },
    {
      "type": 1,
      "content": {
        "json": "## Message Delivery Retried\n",
        "style": "info"
      },
      "name": "text - 19"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"process\" and mimecastEventId_s==\"mail_process_retried\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttCnt_s, AttNames_s, AttSize_s, MsgSize_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "sortBy": []
      },
      "name": "query - 20"
    },
    {
      "type": 1,
      "content": {
        "json": "## Messages with Sandboxed Attachments",
        "style": "info"
      },
      "name": "text - 21"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"process\" and mimecastEventId_s==\"mail_process_sandboxed\"\n| summarize count() by TenantId, SourceSystem, MG, ManagementGroupName, TimeGenerated, Computer, RawData, Err_s, datetime_t, aCode_s, acc_s, Sender_s, Rcpt_s, RcptActType_s, Dir_s, RcptHdrType_s, logType_s, mimecastEventId_s, mimecastEventCategory_s, CustomThreatDictionary_s, Action_s, Hits_s, SimilarCustomExternalDomain_s, TaggedExternal_s, SimilarInternalDomain_s, IP_s, Definition_s, Recipient_s, NewDomain_s, InternalName_s, ThreatDictionary_s, MsgId_s, Subject_s, SimilarMimecastExternalDomain_s, CustomName_s, TaggedMalicious_s, ReplyMismatch_s, Route_s, Delivered_s, AttCnt_s, ReceiptAck_s, Latency_s, AttSize_s, Attempt_s, TlsVer_s, Cphr_s, Snt_s, UseTls_s, Hld_s, IPNewDomain_s, AttNames_s, MsgSize_s, IPThreadDict_s, IPSimilarDomain_s, Act_s, IPReplyMismatch_s, IPInternalName_s, SpamLimit_s, headerFrom_s, SpamInfo_s, SpamScore_s, SpamProcessingDetail_s, fileName_s, sha256_s, Size_s, SenderDomain_s, fileExt_s, sha1_s, fileMime_s, md5_g, RejType_s, Error_s, RejCode_s, RejInfo_s, aCode_g, Virus_s, UrlCategory_s, ScanResultInfo_s, URL_s, MimecastIP_s, SenderDomainInternal_s, CustomerIP_s, SourceIP, reason_s, subject_s, msgid_s, url_s, route_s, sender_s, recipient_s, action_s, urlCategory_s, credentialTheft_s, senderDomain_s, Type, _ResourceId\n| summarize count() by Sender_s, Subject_s, MsgId_s, AttSize_s, AttCnt_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "sortBy": []
      },
      "name": "query - 22"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## Mail Delivery Events",
                    "style": "info"
                  },
                  "name": "text - 4"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "seriesLabelSettings": [
                        {
                          "seriesName": "mail_delivery_delivered",
                          "label": "Delivered with TLS",
                          "color": "green"
                        },
                        {
                          "seriesName": "mail_delivery_delivered_notls",
                          "label": "Delivered without TLS",
                          "color": "orange"
                        },
                        {
                          "seriesName": "mail_delivery_not_delivered",
                          "label": "Undelivered",
                          "color": "red"
                        }
                      ]
                    }
                  },
                  "name": "query - 5"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 2",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## TLS Versions in Use",
                    "style": "info"
                  },
                  "name": "text - 32"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and UseTls_s==\"Yes\"\n| summarize count() by TlsVer_s, bin(TimeGenerated, 1h)\n",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart"
                  },
                  "name": "query - 33"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 4",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## TLS Cipher Suites in Use",
                    "style": "info"
                  },
                  "name": "text - 34"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and UseTls_s==\"Yes\"\n| summarize count() by Cphr_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 35"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 5",
            "styleSettings": {
              "maxWidth": "33%"
            }
          }
        ]
      },
      "name": "group - 31"
    },
    {
      "type": 1,
      "content": {
        "json": "## Undelivered Messages",
        "style": "info"
      },
      "name": "text - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and mimecastEventId_s == \"mail_delivery_not_delivered\"\n| summarize count() by Dir_s, Route_s, Sender_s, Rcpt_s, RejType_s, RejCode_s, RejInfo_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "mail_delivery_not_delivered",
              "label": "Undelivered"
            }
          ]
        }
      },
      "name": "query - 12"
    },
    {
      "type": 1,
      "content": {
        "json": "## Messages Delivered without TLS",
        "style": "info"
      },
      "name": "text - 17"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastSIEM_CL\n| where logType_s==\"delivery\" and mimecastEventId_s==\"mail_delivery_delivered_notls\"\n| summarize count() by Dir_s, Route_s, IP_s, Sender_s, Rcpt_s, Subject_s, Delivered_s, ReceiptAck_s, bin(TimeGenerated, 1h)\n",
        "size": 0,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 18"
    },
    {
      "type": 1,
      "content": {
        "json": "# Data Leak Prevention Events"
      },
      "name": "text - 24"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by mimecastEventId_s, bin(TimeGenerated, 1h)\n",
        "size": 3,
        "timeContext": {
          "durationMs": 1209600000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "group": "mimecastEventId_s",
          "createOtherGroup": 0,
          "seriesLabelSettings": [
            {
              "seriesName": "data_leak_prevention_notification",
              "label": "Notification"
            },
            {
              "seriesName": "data_leak_prevention_hold",
              "label": "Hold"
            },
            {
              "seriesName": "data_leak_prevention_smart_folder",
              "label": "Smart Folder"
            },
            {
              "seriesName": "data_leak_prevention_secure_messaging",
              "label": "Secure Messaging"
            },
            {
              "seriesName": "data_leak_prevention_secure_delivery",
              "label": "Secure Delivery"
            },
            {
              "seriesName": "data_leak_prevention_bounce",
              "label": "Bounce"
            },
            {
              "seriesName": "data_leak_prevention_stationery",
              "label": "Stationary"
            },
            {
              "seriesName": "data_leak_prevention_delete",
              "label": "Delete"
            },
            {
              "seriesName": "data_leak_prevention_meta_expire",
              "label": "Meta Expire"
            },
            {
              "seriesName": "data_leak_prevention_content_expire",
              "label": "Content Expire"
            }
          ]
        }
      },
      "name": "query - 23"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## DLP Events by Route",
                    "style": "info"
                  },
                  "name": "text - 31"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by route_s, bin(TimeGenerated, 1h)\n",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 30"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 2",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## DLP Events by Actions Triggered",
                    "style": "info"
                  },
                  "name": "text - 28"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by action_s, bin(TimeGenerated, 1h)\n",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 29"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 1",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## DLP Events by Policies Triggered",
                    "style": "info"
                  },
                  "name": "text - 26"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastDLP_CL\n| where mimecastEventCategory_s == \"data_leak_prevention\"\n| summarize count() by policy_s, bin(TimeGenerated, 1h)\n",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 1209600000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 27"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 4",
            "styleSettings": {
              "maxWidth": "33%"
            }
          }
        ]
      },
      "name": "group - 36"
    }
  ],
  "fromTemplateId": "sentinel-MimecastSEG",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}