{
	"version": "Notebook/1.0",
	"items": [
	  {
		"type": 1,
		"content": {
		  "json": "# Firework Logs by Risk Score\n---\n\nDisplays Flare events from the past 30 days, broken down by risk score level."
		},
		"name": "text - 2"
	  },
	  {
		"type": 3,
		"content": {
		  "version": "KqlItem/1.0",
		  "query": "FireworkV2_CL\n| make-series num=count() on TimeGenerated from ago(30d) to now() step 8h by strcat(\"Risk Score \", tostring(RiskScore))\n| render timechart",
		  "size": 0,
		  "queryType": 0,
		  "resourceType": "microsoft.operationalinsights/workspaces",
		  "chartSettings": {
			"seriesLabelSettings": [
			  {
				"seriesName": "Risk Score 2",
				"color": "turquoise"
			  },
			  {
				"seriesName": "Risk Score 3",
				"color": "yellow"
			  },
			  {
				"seriesName": "Risk Score 4",
				"color": "orange"
			  },
			  {
				"seriesName": "Risk Score 1",
				"color": "lightBlue"
			  }
			]
		  }
		},
		"name": "query - 2"
	  },
	  {
		"type": 1,
		"content": {
		  "json": "# Collected Document Sources\n\nDisplays a daily bar chart of events over the last 30 days, broken down by source."
		},
		"name": "text - 3"
	  },
	  {
		"type": 3,
		"content": {
		  "version": "KqlItem/1.0",
		  "query": "FireworkV2_CL\n| where isnotempty(source)\n| make-series num=count() on TimeGenerated from ago(30d) to now() step 1d by source\n| render barchart ",
		  "size": 0,
		  "queryType": 0,
		  "resourceType": "microsoft.operationalinsights/workspaces"
		},
		"name": "query - 2"
	  },
	  {
		"type": 3,
		"content": {
		  "version": "KqlItem/1.0",
		  "query": "FireworkV2_CL\n| where TimeGenerated >= ago(30d)\n| summarize num=count() by source\n| where notempty(source)\n| render piechart",
		  "size": 2,
		  "queryType": 0,
		  "resourceType": "microsoft.operationalinsights/workspaces"
		},
		"name": "query - 6"
	  },
	  {
		"type": 1,
		"content": {
		  "json": "# Leaked Credential Events\n---\n\nDisplays a time chart of leaked credential events over the last 30 days, plotted every 8 hours."
		},
		"name": "text - 5"
	  },
	  {
		"type": 3,
		"content": {
		  "version": "KqlItem/1.0",
		  "query": "FireworkV2_CL\n| where notempty(uid) and split(uid, \"/\")[0] == \"leaked_credential\" \n| make-series Total_Leaked_Credentials=count() on TimeGenerated from ago(30d) to now() step 8h \n| render timechart",
		  "size": 0,
		  "queryType": 0,
		  "resourceType": "microsoft.operationalinsights/workspaces",
		  "chartSettings": {
			"seriesLabelSettings": [
			  {
				"seriesName": "Total_Leaked_Credentials",
				"color": "redBright"
			  }
			]
		  }
		},
		"name": "query - 4"
	  }
	],
	"fromTemplateId": "sentinel-FireworkWorkbook",
	"$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }