{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "ccd5adcd-8d59-4cfe-99ec-98075de2e253",
            "version": "KqlParameterItem/1.0",
            "name": "DefaultSubscription_Internal",
            "type": 1,
            "isRequired": true,
            "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
            "crossComponentResources": [
              "value::selected"
            ],
            "isHiddenWhenLocked": true,
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\r\n",
            "crossComponentResources": [
              "value::selected"
            ],
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources",
            "label": "☁️ Subscription"
          },
          {
            "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511",
            "version": "KqlParameterItem/1.0",
            "name": "Workspace",
            "label": "🗂️ Workspace",
            "type": 5,
            "isRequired": true,
            "query": "resources\n| where type =~ 'microsoft.operationalinsights/workspaces' \n//| where subscriptionId == '{Subscription:id}'\n| project id",
            "crossComponentResources": [
              "{Subscription}"
            ],
            "value": "",
            "typeSettings": {
              "resourceTypeFilter": {
                "microsoft.operationalinsights/workspaces": true
              },
              "additionalResourceOptions": []
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "label": "⏱️ Time Range"
          },
          {
            "id": "c71f3009-a3f4-4aa5-aaf0-d0f667100e56",
            "version": "KqlParameterItem/1.0",
            "name": "Help",
            "label": "📖 Help",
            "type": 10,
            "description": "This will show some help information to help you understand the page you are on",
            "isRequired": true,
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "jsonData": "[\r\n { \"value\": \"Yes\", \"label\": \"Yes\"},\r\n { \"value\": \"No\", \"label\": \"No\", \"selected\":true },\r\n { \"value\": \"Change Log\", \"label\": \"Change Log\"}\r\n]"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "## AI Shield  Workbook\r\n### Change Log\r\nUse this report to analyze the Zoom Reports logs ingested.\r\nThis Workbook also require a parser to be deployed.\r\n\r\n|Version|Description|\r\n|---|---|\r\n|v1.0|Initial Workbook Created| \r\n\r\n"
      },
      "conditionalVisibility": {
        "parameterName": "Help",
        "comparison": "isEqualTo",
        "value": "Change Log"
      },
      "name": "text - 0"
    },
    {
      "type": 1,
      "content": {
        "json": "## Usage\r\n\t- Please select your **Subscription** and **Workspace**\r\n\t- Time Range: is the time you wish to query back to. i.e 7days from now, into the past."
      },
      "conditionalVisibility": {
        "parameterName": "Help",
        "comparison": "isEqualTo",
        "value": "Yes"
      },
      "name": "text - 0 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by bin(TimeGenerated,{TimeRange:grain})",
        "size": 0,
        "title": "Activity Over Time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - 4 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by Severity",
        "size": 4,
        "title": "Across Severity",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "query - 4 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by ServiceName",
        "size": 4,
        "title": "Across ServiceName",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "query - 4 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by AttackName\r\n",
        "size": 4,
        "title": "Across AttackName",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "query - 4 - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by AssetId\r\n",
        "size": 4,
        "title": "Across AssetId",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "query - 4 - Copy - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AIShield\r\n| summarize count() by Message\r\n",
        "size": 0,
        "title": "Messages",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "query - 4 - Copy - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield \r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Severity);\r\nAIShield\r\n| summarize [\"Count\"] = count() by Severity\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.Severity == $right.Severity\r\n| project-away TimeGenerated,Severity1",
        "size": 1,
        "title": "Trend on Severity",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 21,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield\r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ServiceName);\r\nAIShield\r\n| summarize [\"Count\"] = count() by ServiceName\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.ServiceName == $right.ServiceName\r\n| project-away TimeGenerated,ServiceName1",
        "size": 1,
        "title": "Trend on ServiceName",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 21,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield \r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AttackName);\r\nAIShield\r\n| summarize [\"Count\"] = count() by AttackName\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.AttackName == $right.AttackName\r\n| project-away TimeGenerated,AttackName1",
        "size": 1,
        "title": "Trend on AttackName",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield \r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AssetId);\r\nAIShield\r\n| summarize [\"Count\"] = count() by AssetId\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.AssetId == $right.AssetId\r\n| project-away TimeGenerated,AssetId1",
        "size": 1,
        "title": "Trend on AssetId",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield \r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SourceName);\r\nAIShield\r\n| summarize [\"Count\"] = count() by SourceName\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.SourceName == $right.SourceName\r\n| project-away TimeGenerated,SourceName1",
        "size": 1,
        "title": "Trend on SourceName",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield \r\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Message);\r\nAIShield\r\n| summarize [\"Count\"] = count() by Message\r\n| join kind =inner\r\n(\r\ntrend_data\r\n) on $left.Message == $right.Message\r\n| project-away TimeGenerated,Message1",
        "size": 1,
        "title": "Trend on Message",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - 4 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AssetId, AttackName, Message);\r\nAIShield\r\n| summarize arg_max(EventTimestamp,*), [\"Activity Count\"] = count() by AssetId, AttackName, Message\r\n|join kind=inner\r\n(\r\ntrend_data\r\n) on $left.AssetId== $right.AssetId, $left.AttackName== $right.AttackName,$left.Message== $right.Message\r\n| project AssetId, AttackName, Message,[\"Activity Count\"], EventTimestamp, Trend",
        "size": 2,
        "title": "Latest AttackName &  Message on AssetId with Trend",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "AssetId",
              "formatter": 1
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "redDark"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 21,
              "formatOptions": {
                "palette": "red",
                "compositeBarSettings": {
                  "labelText": "",
                  "columnSettings": []
                }
              }
            },
            {
              "columnMatch": "Group",
              "formatter": 1
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "AssetId"
            ],
            "expandTopLevel": true
          }
        }
      },
      "name": "query - 4 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ServiceName, AttackName, Message);\r\nAIShield\r\n| summarize arg_max(EventTimestamp,*), [\"Activity Count\"] = count() by ServiceName, AttackName, Message\r\n|join kind=inner\r\n(\r\ntrend_data\r\n) on $left.ServiceName== $right.ServiceName, $left.AttackName== $right.AttackName,$left.Message== $right.Message\r\n| project ServiceName, AttackName, Message,[\"Activity Count\"], EventTimestamp, Trend",
        "size": 2,
        "title": "Latest AttackName &  Message on ServiceName with Trend",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ServiceName",
              "formatter": 1
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "redBright"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "redBright"
              }
            },
            {
              "columnMatch": "Group",
              "formatter": 1
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "ServiceName"
            ],
            "expandTopLevel": true
          }
        }
      },
      "name": "query - 4 - Copy - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let trend_data = (AIShield | make-series Trend = dcount(AssetId) default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by AttackName, Message);\r\nAIShield\r\n| summarize arg_max(EventTimestamp,*), [\"AssetId Count\"] = dcount(AssetId) by AttackName, Message\r\n|join kind=inner\r\n(\r\ntrend_data\r\n) on $left.AttackName== $right.AttackName, $left.Message== $right.Message\r\n| project AttackName, Message,[\"AssetId Count\"], EventTimestamp, Trend",
        "size": 2,
        "title": "Attack on Multiple Assets with Trend",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Group",
              "formatter": 1
            },
            {
              "columnMatch": "AttackName",
              "formatter": 1
            },
            {
              "columnMatch": "AssetId Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "red"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 21,
              "formatOptions": {
                "palette": "red"
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "AttackName"
            ],
            "expandTopLevel": true
          }
        }
      },
      "name": "query - 4 - Copy - Copy - Copy - Copy - Copy"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-AIShield",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}