{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "cd8447d9-b096-4673-9613-2a7c1f8f5e3f",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 2592000000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union BeyondTrustPM_ActivityAudits_CL, BeyondTrustPM_ClientEvents_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by Type\n| extend TableName = case(\n    Type == \"BeyondTrustPM_ActivityAudits_CL\", \"Activity Audits\",\n    Type == \"BeyondTrustPM_ClientEvents_CL\", \"Client Events\",\n    \"Other\"\n  )\n| project TableName, Count",
        "size": 3,
        "title": "Event Summary",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "TableName",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "showBorder": false
        }
      },
      "name": "event-summary-tiles"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ActivityAudits_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| render timechart",
        "size": 0,
        "title": "Activity Audits Over Time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "activity-audits-timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ClientEvents_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| render timechart",
        "size": 0,
        "title": "Client Events Over Time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "client-events-timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ActivityAudits_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by ActionType = tostring(details)\n| top 10 by Count desc\n| render barchart",
        "size": 0,
        "title": "Top Activity Audit Actions",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "top-audit-actions"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ClientEvents_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by EventType = tostring(eventAction)\n| top 10 by Count desc\n| render barchart",
        "size": 0,
        "title": "Top Client Event Types",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "top-event-types"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ActivityAudits_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by User = tostring(user)\n| top 10 by Count desc\n| project User, Activities = Count",
        "size": 0,
        "title": "Top Users by Activity Audits",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "top-users-audits"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ClientEvents_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by Host = tostring(hostHostname)\n| top 10 by Count desc\n| project Host, Events = Count",
        "size": 0,
        "title": "Top Hosts by Client Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "top-hosts-events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ActivityAudits_CL\n| where TimeGenerated {TimeRange}\n| project TimeGenerated, \n    Action = details,\n    User = user,\n    Entity = entity,\n    AuditType = auditType,\n    ChangedBy = changedBy\n| order by TimeGenerated desc\n| take 50",
        "size": 0,
        "title": "Recent Activity Audits",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "recent-audits-table"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "BeyondTrustPM_ClientEvents_CL\n| where TimeGenerated {TimeRange}\n| project TimeGenerated,\n    EventAction = eventAction,\n    Host = hostHostname,\n    User = userName,\n    FileName = fileName,\n    Process = processExecutable\n| order by TimeGenerated desc\n| take 50",
        "size": 0,
        "title": "Recent Client Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "recent-events-table"
    }
  ],
  "fromTemplateId": "sentinel-BeyondTrustPMCloudWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}