{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "66b37ec4-c2ff-49bd-b434-6c439220c04f",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 43200000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "## Overview"
      },
      "name": "text - 24"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\n| summarize TotalRequests = count() by bin(TimeGenerated, {TimeRange:grain})\n| order by TimeGenerated desc",
        "size": 1,
        "title": "Total API Requests Over Time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\n| extend ClientAuthMethod = case(ClientAuthMethod == 0, \"Public client\",\nClientAuthMethod == 1, \"Client Secret\",\"Client Certifiate\"\n)\n| summarize TotalRequests = count() by ClientAuthMethod\n| order by TotalRequests desc",
        "size": 1,
        "title": "API Requests by Authentication Method",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "query - 2 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\n| summarize TotalRequests = count() by AppId\n| order by TotalRequests desc",
        "size": 1,
        "title": "API Requests by Application",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "40",
      "name": "query - 2 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\n| summarize CountRequests = count() by ResponseStatusCode\n| order by CountRequests desc",
        "size": 1,
        "title": "Response Status Overview",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "CountRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "gray"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "40",
      "name": "query - 2 - Copy - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## Performance & Latency Insights"
      },
      "name": "text - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| summarize AvgDurationMs = avg(DurationMs)\r\n",
        "size": 0,
        "title": "Average API Request Duration",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "AvgDurationMs",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            },
            "numberFormat": {
              "unit": 22,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": false
        }
      },
      "customWidth": "15",
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| summarize AvgDurationMs = avg(DurationMs) by bin(TimeGenerated, {TimeRange:grain})\r\n| order by TimeGenerated desc\r\n",
        "size": 0,
        "title": "Average API Request Duration",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "85",
      "name": "query - 6 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where DurationMs > 5000\r\n| summarize TotalSlowRequests = count() by RequestUri\r\n| order by TotalSlowRequests desc\r\n",
        "size": 0,
        "title": "Average API Request Duration",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalSlowRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 6 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where DurationMs > 5000\r\n| summarize TotalSlowRequests = count()",
        "size": 0,
        "title": "Slow API Requests (>5 sec)",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "20",
      "name": "query - 6 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where DurationMs > 5000\r\n| summarize TotalSlowRequests = count() by bin(TimeGenerated, {TimeRange:grain})\r\n| order by TotalSlowRequests desc\r\n",
        "size": 0,
        "title": "Slow API Requests (>5 sec) Over Time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "80",
      "name": "query - 6 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| summarize TotalRequests = count() by bin(TimeGenerated, {TimeRange:grain})\r\n| order by TotalRequests desc",
        "size": 0,
        "title": "Peak Usage Hours",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - 6 - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## Monitoring"
      },
      "name": "text - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where ResponseStatusCode >= 400\r\n| summarize TotalFailedRequests = count()\r\n",
        "size": 0,
        "title": "Failed API Requests (4xx & 5xx)",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "20",
      "name": "query - 10"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where ResponseStatusCode >= 400\r\n| extend ResponseStatus = case(ResponseStatusCode >= 400 and ResponseStatusCode < 500 , \"Bad Request: The request syntax or parameters are invalid\",\r\nResponseStatusCode >= 500 and ResponseStatusCode < 600,\"Internal Server Error: The server encountered an unexpected error\",\r\n\"Unknown\")\r\n| summarize count() by ResponseStatus, bin(TimeGenerated,{TimeRange:grain})",
        "size": 0,
        "title": "Failed API Requests (4xx & 5xx)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "80",
      "name": "query - 10 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where ClientAuthMethod == \"Unknown\" or ResponseStatusCode == 401\r\n| summarize TotalSuspiciousRequests = count()\r\n",
        "size": 0,
        "title": "Suspicious Authentication Patterns",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "20",
      "name": "query - 10 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where Scopes has \"User.ReadWrite.All\" or Scopes has \"Directory.ReadWrite.All\"\r\n| summarize TotalRequests = count() by AppId, UserId\r\n| order by TotalRequests desc",
        "size": 0,
        "title": "API Requests with Sensitive Scopes (Elevated Permissions) [User.ReadWrite.All, Directory.ReadWrite.All]",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "rowLimit": 10000,
          "filter": true
        }
      },
      "customWidth": "80",
      "name": "query - 10 - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = (MicrosoftGraphActivityLogs\r\n| summarize  count() by IPAddress, bin(TimeGenerated,{TimeRange:grain})\r\n| summarize Trend = makelist(count_) by IPAddress\r\n);\r\nMicrosoftGraphActivityLogs\r\n| summarize TotalRequests = count() by IPAddress\r\n| join kind=inner(data)\r\non $left.IPAddress == $right.IPAddress\r\n| project-away IPAddress1\r\n| order by TotalRequests desc\r\n\r\n",
        "size": 0,
        "title": "Request based on IP Address",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 10 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = (MicrosoftGraphActivityLogs\r\n| summarize  count() by Location, bin(TimeGenerated,{TimeRange:grain})\r\n| summarize Trend = makelist(count_) by Location\r\n);\r\nMicrosoftGraphActivityLogs\r\n| summarize RequestCount = count() by Location\r\n| order by RequestCount desc\r\n| join kind=inner(data)\r\non $left.Location == $right.Location\r\n| project-away Location1\r\n| order by RequestCount desc\r\n\r\n",
        "size": 0,
        "title": "Requests based on Location",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "RequestCount",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 10 - Copy - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## Usage & Optimization"
      },
      "name": "text - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| summarize TotalRequests = count() by RequestUri\r\n| order by TotalRequests desc",
        "size": 0,
        "title": "API Requests by Endpoint",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 14"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = (MicrosoftGraphActivityLogs\r\n| summarize  count() by ApiVersion, bin(TimeGenerated,{TimeRange:grain})\r\n| summarize Trend = makelist(count_) by ApiVersion\r\n);\r\nMicrosoftGraphActivityLogs\r\n| summarize TotalRequests = count() by ApiVersion\r\n| join kind=inner(data)\r\non $left.ApiVersion == $right.ApiVersion\r\n| project-away ApiVersion1\r\n| order by TotalRequests desc",
        "size": 1,
        "title": "API Version Adoption Trends",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "name": "query - 14 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = (MicrosoftGraphActivityLogs\r\n| summarize  count() by UserId, bin(TimeGenerated,{TimeRange:grain})\r\n| summarize Trend = makelist(count_) by UserId\r\n);\r\nMicrosoftGraphActivityLogs\r\n| summarize TotalRequests = count() by UserId\r\n| join kind=inner(data)\r\non $left.UserId == $right.UserId\r\n| project-away UserId1\r\n| order by TotalRequests desc\r\n| where isnotempty(UserId)\r\n",
        "size": 0,
        "title": "User Request Trends",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalRequests",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "name": "query - 14 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MicrosoftGraphActivityLogs\r\n| where DurationMs > 10000 or ResponseStatusCode == 500\r\n| summarize TotalUnusualRequests = count() by bin(TimeGenerated,{TimeRange:grain})\r\n",
        "size": 0,
        "title": "Unusual API Request Patterns",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "name": "query - 18"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-MicrosoftGraphActivityLogsWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}