{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Cisco Identity Services Engine\nCisco ISE allows you to provide highly secure network access to users and devices. It helps you gain visibility into what is happening in your network, such as who is connected, which applications are installed and running, and much more. It also shares vital contextual data, such as user and device identities, threats, and vulnerabilities with integrated solutions from Cisco technology partners, so you can identify, contain, and remediate threats faster.",
        "style": "info"
      },
      "name": "Text"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "88aa96e3-fc48-4b04-836e-fc2ec8ebf37f",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": " Time Range",
            "type": 4,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "Parameters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventCategory;",
        "size": 0,
        "title": "Events over time",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "70",
      "name": "EventsOverTime"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| summarize TotalEvents = count() by EventSeverity",
        "size": 4,
        "title": "Event Severity Distribution",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "EventSeverity",
            "formatter": 1,
            "numberFormat": {
              "unit": 0,
              "options": {
                "style": "decimal"
              }
            }
          },
          "leftContent": {
            "columnMatch": "TotalEvents",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            }
          },
          "showBorder": true,
          "rowLimit": 7,
          "size": "auto"
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "EventSeverity",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "TotalEvents",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "customWidth": "30",
      "name": "EventSeverityDistribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\n| summarize TotalEvents = count() by EventCategory\n| join kind = inner (CiscoISEEvent\n      | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventCategory)\n      on EventCategory\n| project-away EventCategory1, TimeGenerated\n| project EventCategory, TotalEvents, Trend\n| order by TotalEvents desc\n\n\n",
        "size": 4,
        "title": "Event Categories Distribution",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "EventCategory",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "TotalEvents",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "blue"
            }
          },
          "showBorder": false,
          "rowLimit": 10
        }
      },
      "name": "EventCategoriesDistribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| where DvcHostname != ''\r\n| summarize TotalEvents = count() by DvcHostname\r\n| join kind = inner (CiscoISEEvent\r\n | where DvcHostname != ''\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DvcHostname)\r\n on DvcHostname\r\n| project-away DvcHostname1, TimeGenerated\r\n| project DvcHostname, TotalEvents, Trend\r\n| order by TotalEvents\r\n| take 10\r\n",
        "size": 0,
        "title": "Top Reporting Devices",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalEvents",
              "formatter": 8,
              "formatOptions": {
                "palette": "blueGreen"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 10,
              "formatOptions": {
                "palette": "turquoise"
              }
            }
          ],
          "rowLimit": 10,
          "labelSettings": [
            {
              "columnId": "TotalEvents",
              "label": "Total Events"
            },
            {
              "columnId": "Trend"
            }
          ]
        }
      },
      "customWidth": "31",
      "name": "TopReportingDevices"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| where DstUserName != ''\r\n| summarize TotalEvents = count() by DstUserName\r\n| order by TotalEvents\r\n| take 10",
        "size": 3,
        "title": "Top Users Activity (Events)",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {}
      },
      "customWidth": "30",
      "name": "TopUsersActivity "
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| where EventId in ('5400', '5401')\r\n| where DstUserName != ''\r\n| summarize TotalEvents = count() by DstUserName\r\n",
        "size": 0,
        "title": "Top Users with Failed Authentication",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {}
      },
      "customWidth": "30",
      "name": "TopUsersFailedAuthentication"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| where PostureStatus != ''\r\n| where PostureStatus != 'Compliant'\r\n| summarize TotalEvents = count() by DstIpAddr\r\n\r\n",
        "size": 1,
        "title": "Non-Compliant Posture Status",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "NonCompliantPostureStatus"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CiscoISEEvent\r\n| where EventSeverity in ('FATAL', 'ERROR')\r\n| summarize errorCnt = count() by EventId, ErrorMessage = EventMessage\r\n| sort by errorCnt\r\n| project ['❌ Error Code'] = EventId, ['Error Message'] = ErrorMessage , ['Error Count'] = toint(errorCnt)",
        "size": 1,
        "title": "Details of top errors",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "39",
      "name": "DetailsTopErrors"
    }
  ],
  "fromTemplateId": "sentinel-CiscoISE",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}