{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "b5affbc4-b123-4844-bab6-a352911dcd05",
                        "version": "KqlParameterItem/1.0",
                        "name": "bhe_tenant",
                        "label": "BHE Tenant",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEFindingTrendsData_CL \n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "511679f9-e193-414d-9d06-c778e0372a69",
                        "version": "KqlParameterItem/1.0",
                        "name": "domain_name",
                        "label": "Environment",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEFindingTrendsData_CL\n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| distinct domain_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "bfad7f56-9fd7-4cc1-9386-5be8422b9eeb",
                        "version": "KqlParameterItem/1.0",
                        "name": "period",
                        "label": "Time Period",
                        "type": 2,
                        "isRequired": true,
                        "query": "BHEFindingTrendsData_CL\r\n| where tenant_url in~ ({bhe_tenant})\r\n| where domain_name in~ ({domain_name})\r\n| distinct period\r\n",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::1"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::1",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "key": "bfad7f56-9fd7-4cc1-9386-5be8422b9eeb"
                    },
                    {
                        "id": "56999a28-3611-436b-8b96-98bd48de863a",
                        "version": "KqlParameterItem/1.0",
                        "name": "category",
                        "label": "Finding Category",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEFindingTrendsData_CL\r\n| where isnotempty(domain_name)\r\n| where tenant_url in~ ({bhe_tenant})\r\n| where domain_name in~ ({domain_name})\r\n| where period == \"{period}\"\r\n| extend display_type = replace_string(display_type, \" Attack Paths\", \"\")\r\n| distinct display_type",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "selectAllValue": "",
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEFindingTrendsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where period == \"{period}\"\n| extend display_type = replace_string(display_type, \" Attack Paths\", \"\")\n| summarize arg_max(TimeGenerated, *) by display_title, finding\n| where display_type in~ ({category})\n| extend count = finding_count_end\n| extend change = finding_count_increase - finding_count_decrease\n| project \n    [\"Name\"] = display_title,\n    [\"Finding Category\"] = display_type,\n    [\"Count\"] = count,\n    [\"Initial Findings\"] = finding_count_start,\n    [\"New Findings\"] = finding_count_increase,\n    [\"Resolved Findings\"] = finding_count_decrease,\n    [\"Change\"] = change,\n    [\"Period\"] = period\n\n\n",
                "size": 0,
                "title": "Attack Path Trends",
                "noDataMessageStyle": 2,
                "timeContext": {
                    "durationMs": 604800000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "table",
                "tileSettings": {
                    "showBorder": false
                },
                "graphSettings": {
                    "type": 0
                },
                "chartSettings": {
                    "createOtherGroup": 20,
                    "showLegend": true
                },
                "mapSettings": {
                    "locInfo": "LatLong",
                    "sizeSettings": "TotalImpactCount",
                    "sizeAggregation": "Sum",
                    "legendMetric": "TotalImpactCount",
                    "legendAggregation": "Sum",
                    "itemColorSettings": {
                        "type": "heatmap",
                        "colorAggregation": "Sum",
                        "nodeColorField": "TotalImpactCount",
                        "heatmapPalette": "greenRed"
                    }
                }
            },
            "name": "query - 3 - Copy"
        }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-BloodHoundEnterprise",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}