{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 1,
            "name": "title",
            "content": {
                "json": "# Utimaco ESKM — KMIP Monitoring\n---\nKey security signals from your Utimaco Enterprise Secure Key Manager: activity baseline, event distribution, operation outcomes and authentication health.\n\nUse the **Time Range** filter to scope every chart on this page."
            }
        },
        {
            "type": 9,
            "name": "filters",
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "e234304e-41d6-4139-944d-baba8c4da127",
                        "version": "KqlParameterItem/1.0",
                        "name": "TimeRange",
                        "label": "Time Range",
                        "type": 4,
                        "isRequired": true,
                        "value": {
                            "durationMs": 604800000
                        },
                        "typeSettings": {
                            "selectableValues": [
                                { "durationMs": 3600000 },
                                { "durationMs": 14400000 },
                                { "durationMs": 43200000 },
                                { "durationMs": 86400000 },
                                { "durationMs": 172800000 },
                                { "durationMs": 604800000 },
                                { "durationMs": 1209600000 },
                                { "durationMs": 2419200000 }
                            ],
                            "allowCustom": true
                        }
                    }
                ],
                "style": "pills",
                "title": "Filters"
            }
        },
        {
            "type": 1,
            "name": "section-overview",
            "content": {
                "json": "### Overview"
            }
        },
        {
            "type": 3,
            "name": "kpi-tiles",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| summarize TotalEvents = count(), UniqueUsers = dcountif(User, isnotempty(User)), UniqueIPs = dcountif(IP, isnotempty(IP)), Failed = countif(isnotempty(Result) and Result != 'SUCCESS')\n| extend FailurePct = iff(TotalEvents == 0, 0, toint(round(100.0 * Failed / TotalEvents, 0)))\n| project Metrics = pack_array(\n    pack('Metric', 'Total events', 'Value', TotalEvents, 'Sort', 1),\n    pack('Metric', 'Unique users', 'Value', UniqueUsers, 'Sort', 2),\n    pack('Metric', 'Unique source IPs', 'Value', UniqueIPs, 'Sort', 3),\n    pack('Metric', 'Failure %', 'Value', FailurePct, 'Sort', 4)\n)\n| mv-expand Metrics\n| project Metric = tostring(Metrics.Metric), Value = tolong(Metrics.Value), Sort = toint(Metrics.Sort)\n| order by Sort asc\n| project Metric, Value",
                "size": 3,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "visualization": "tiles",
                "tileSettings": {
                    "titleContent": { "columnMatch": "Metric", "formatter": 1 },
                    "leftContent": { "columnMatch": "Value", "formatter": 12, "formatOptions": { "palette": "auto" } },
                    "showBorder": true
                }
            }
        },
        {
            "type": 1,
            "name": "section-activity-mix",
            "content": {
                "json": "### Activity Mix"
            }
        },
        {
            "type": 3,
            "name": "event-distribution",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| where isnotempty(Event)\n| summarize Count = count() by Event\n| order by Count desc",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "Event distribution",
                "visualization": "barchart"
            },
            "customWidth": "50"
        },
        {
            "type": 3,
            "name": "top-kmip-operations",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| where isnotempty(Operation)\n| summarize Count = count() by Operation\n| order by Count desc\n| take 10",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "Top KMIP operations",
                "visualization": "barchart"
            },
            "customWidth": "50"
        },
        {
            "type": 1,
            "name": "section-outcomes",
            "content": {
                "json": "### KMIP Operation Outcomes"
            }
        },
        {
            "type": 3,
            "name": "operation-results",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| where isnotempty(Operation) and isnotempty(Result)\n| extend ResultCategory = iif(Result == 'SUCCESS', 'Success', 'Failure')\n| summarize Count = count() by ResultCategory\n| order by Count desc",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "Success vs Failure",
                "visualization": "piechart"
            },
            "customWidth": "50"
        },
        {
            "type": 3,
            "name": "failed-operations",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| where isnotempty(Result) and Result != 'SUCCESS'\n| where isnotempty(Operation)\n| summarize Count = count() by Operation\n| order by Count desc\n| take 10",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "Failed operations breakdown",
                "visualization": "barchart"
            },
            "customWidth": "50"
        },
        {
            "type": 1,
            "name": "section-auth",
            "content": {
                "json": "### Authentication Activity"
            }
        },
        {
            "type": 3,
            "name": "auth-trend",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| where Event in ('Authentication Success', 'Authentication Failure')\n| summarize Count = count() by bin(TimeGenerated, 15m), Event\n| order by TimeGenerated asc",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "Authentication success vs failure trend",
                "visualization": "timechart",
                "chartSettings": {
                    "createOtherGroup": 0,
                    "seriesLabelSettings": [
                        { "seriesName": "Authentication Success", "color": "green" },
                        { "seriesName": "Authentication Failure", "color": "redBright" }
                    ]
                }
            }
        },
        {
            "type": 1,
            "name": "section-timeline",
            "content": {
                "json": "### Activity Timeline"
            }
        },
        {
            "type": 3,
            "name": "activity-trend",
            "content": {
                "version": "KqlItem/1.0",
                "query": "UtimacoESKMKmipServerLogs_CL\n| summarize Count = count() by bin(TimeGenerated, 15m)\n| order by TimeGenerated asc",
                "size": 0,
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "timeContextFromParameter": "TimeRange",
                "title": "KMIP activity over time",
                "visualization": "timechart"
            }
        }
    ],
    "styleSettings": {},
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-utimaco-eskm-workbook",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}