{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Cribl Workbook\r\n\r\nThis Workbook contains summary of \r\n\r\n\r\n| Access Logs | Audit Logs | Internal Logs | UI Access Logs|\r\n| -------------- | --------------- | -------------- | -------------- |\r\n| Included | Included | Included | Included |"
      },
      "customWidth": "50",
      "name": "text - 19"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "007ea1ee-99dd-4c59-bc0f-7eb8b1e05c71",
            "version": "KqlParameterItem/1.0",
            "name": "TimeGenerated",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "parameters - 21"
    },
    {
      "type": 1,
      "content": {
        "json": "# Access Logs\n---\n",
        "style": "info"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| summarize Count = count() by tostring(status)",
        "size": 1,
        "title": "Summary of HTTP Status Code",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "33",
      "name": "HTTP Status Code Overview"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| summarize count() by method\n",
        "size": 1,
        "title": "Summary of HTTP Methods",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "33",
      "name": "httpMethodSummary"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| summarize Count = count() by src",
        "size": 1,
        "title": "Summary of Source",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "customWidth": "33",
      "name": "httpMethodsSummary"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| summarize Hits = count() by url\n| top 10 by Hits\n",
        "size": 0,
        "title": "Top Accessed API Endpoints",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Top Accessed API Endpoints"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| extend statusCode = toint(status)\n| where statusCode >= 400\n| summarize ErrorCount = count() by tostring(statusCode)\n| sort by ErrorCount desc\n",
        "size": 0,
        "title": "HTTP Error Code Summary",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "HTTP Error Code Summary"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAccess\n| summarize AvgResponseTime = avg(response_time) by url\n| top 10 by AvgResponseTime\n\n",
        "size": 0,
        "title": "API Response Time Analysis",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "name": "API Response Time Analysis"
    },
    {
      "type": 1,
      "content": {
        "json": "#  Audit Logs\n---\n",
        "style": "info"
      },
      "name": "text - 2 - Copy"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CriblAudit\n| summarize Count = count() by service\n",
              "size": 1,
              "title": "Summary of Services",
              "timeContextFromParameter": "TimeGenerated",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Count",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "auditServiceSummaryTable"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CriblAudit\n| summarize Count = count() by user\n| top 5 by Count\n",
              "size": 1,
              "title": "Top 5 Users by Audit Events",
              "timeContextFromParameter": "TimeGenerated",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "showMetrics": false,
                "showLegend": true
              }
            },
            "customWidth": "50",
            "name": "Top 5 Users by Audit Events"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CriblAudit\n| where event_time between ({TimeGenerated:start} .. {TimeGenerated:end})\n| summarize Count = count() by bin(event_time, {TimeGenerated:grain})\n",
              "size": 0,
              "title": "Requests Over Time",
              "timeContextFromParameter": "TimeGenerated",
              "showRefreshButton": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "name": "Requests Over Time"
          }
        ]
      },
      "name": "auditLogsRequestsOverTimeGroup"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAudit\n| summarize Count = count() by action\n| order by Count desc\n",
        "size": 0,
        "title": "Most Performed Audit Actions",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "name": "Most Performed Audit Actions"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAudit\n| summarize UniqueUsers = dcount(user) by action\n| order by UniqueUsers desc\n",
        "size": 0,
        "title": "User Participation by Action Type",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "User Participation by Action Type"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAudit\n| where event_time between (datetime({TimeGenerated:start}) .. datetime({TimeGenerated:end}))\n| summarize Count = count() by bin(event_time, 5m)\n| order by event_time asc\n",
        "size": 0,
        "title": "Audit Event Activity Over Time",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "Audit Event Activity Over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblAudit\n| summarize Count = count() by service, action\n| order by service asc\n",
        "size": 0,
        "title": "Actions by Cribl Service Module",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Actions by Cribl Service Module"
    },
    {
      "type": 1,
      "content": {
        "json": "#  Internal Logs\n---\n",
        "style": "info"
      },
      "name": "text - 2 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblInternal\n| summarize avg(cpuPerc) by service\n| order by avg_cpuPerc desc\n",
        "size": 0,
        "title": "Average CPU Usage per Cribl Component",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "name": "Average CPU Usage per Cribl Component"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblInternal\n| summarize avg(mem_rss) by service\n| order by avg_mem_rss desc\n",
        "size": 0,
        "title": "Average Memory (RSS) Usage by Component",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Average Memory (RSS) Usage by Component"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblInternal\n| where event_time between ({TimeGenerated:start} .. {TimeGenerated:end})\n| summarize avg(cpuPerc), avg(eluPerc) by bin(event_time, {TimeGenerated:grain})\n",
        "size": 0,
        "title": "CPU vs ELU Over Time",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "name": "CPU vs ELU Over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblInternal\n| summarize avg(mem_heap), avg(mem_heapTotal) by bin(event_time, 1m)\n",
        "size": 0,
        "title": "Heap vs Total Heap Memory Over Time",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "name": "Heap vs Total Heap Memory Over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblInternal\n| summarize avg(mem_rss) by instance\n| top 5 by avg_mem_rss\n",
        "size": 0,
        "title": "Top 5 Hosts by RSS Memory Usage",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top 5 Hosts by RSS Memory Usage"
    },
    {
      "type": 1,
      "content": {
        "json": "#  UI Access Logs\n---\n",
        "style": "info"
      },
      "name": "text - 2 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| summarize Count = count() by user\n| top 5 by Count\n",
        "size": 1,
        "title": "Top 5 Users Accessing Cribl UI",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Top 5 Users Accessing Cribl UI"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| summarize Count = count() by tenantId\n| top 5 by Count\n",
        "size": 1,
        "title": "Top 5 Tenants Accessing Cribl UI",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "Top 5 Tenants Accessing Cribl UI"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| summarize Count = count() by url\n| order by Count desc\n",
        "size": 0,
        "title": "Most Accessed UI Pages",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "name": "Most Accessed UI Pages"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| where event_time between (datetime({TimeGenerated:start}) .. datetime({TimeGenerated:end}))\n| summarize AccessCount = count() by bin(event_time, 1m)\n| order by event_time asc\n",
        "size": 0,
        "title": "Cribl UI Access Trend",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "Cribl UI Access Trend"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| summarize AccessCount = count() by src\n| top 10 by AccessCount\n",
        "size": 0,
        "title": "Top Source IPs Accessing UI",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top Source IPs Accessing UI"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CriblUIAccess\n| summarize Count = count() by http_user_agent\n| top 5 by Count\n",
        "size": 0,
        "title": "Most Common Browsers & Tools",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Most Common Browsers & Tools"
    }
  ],
  "fromTemplateId": "sentinel-CriblWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}