{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "a4422263-5b38-4e1b-96bf-010956675fe7",
                        "version": "KqlParameterItem/1.0",
                        "name": "bhe_tenant",
                        "label": "BHE Tenant",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEPostureHistoryData_CL\n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "627c2e6a-326c-479e-a0aa-9a5c0354c719",
                        "version": "KqlParameterItem/1.0",
                        "name": "domain_name",
                        "label": "Environment",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHEPostureHistoryData_CL\n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| distinct domain_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "2318e21e-11ac-4959-8c09-8e2f0cce91c7",
                        "version": "KqlParameterItem/1.0",
                        "name": "time",
                        "label": "Time Range Picker",
                        "type": 4,
                        "isRequired": true,
                        "typeSettings": {
                            "selectableValues": [
                                {
                                    "durationMs": 300000
                                },
                                {
                                    "durationMs": 900000
                                },
                                {
                                    "durationMs": 1800000
                                },
                                {
                                    "durationMs": 3600000
                                },
                                {
                                    "durationMs": 14400000
                                },
                                {
                                    "durationMs": 43200000
                                },
                                {
                                    "durationMs": 86400000
                                },
                                {
                                    "durationMs": 172800000
                                },
                                {
                                    "durationMs": 259200000
                                },
                                {
                                    "durationMs": 604800000
                                },
                                {
                                    "durationMs": 1209600000
                                },
                                {
                                    "durationMs": 2419200000
                                },
                                {
                                    "durationMs": 2592000000
                                },
                                {
                                    "durationMs": 5184000000
                                },
                                {
                                    "durationMs": 7776000000
                                }
                            ]
                        },
                        "value": {
                            "durationMs": 604800000
                        }
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEPostureHistoryData_CL\n| where data_type == \"exposure\"\n| where domain_name in~ ({domain_name}) and tenant_url in~ ({bhe_tenant})\n| where metric_date {time}\n| extend metric_ts = todatetime(metric_date)\n| summarize avg_exposure = avg(todouble(value)) by bin(metric_ts, 1d), domain_name, tenant_url\n| extend avg_exposure = round(avg_exposure, 3) * 100\n| order by metric_ts asc\n",
                "size": 0,
                "title": "Exposure Percentage",
                "timeContextFromParameter": "time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart",
                "chartSettings": {
                    "showLegend": true
                }
            },
            "name": "query - 3"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEPostureHistoryData_CL\n| where data_type == \"findings\"\n| where domain_name in~ ({domain_name}) and tenant_url in~ ({bhe_tenant})\n| where metric_date {time}\n| extend metric_ts = todatetime(metric_date)\n| summarize avg_findings = avg(todouble(value)) by bin(metric_ts, 1d), domain_name, tenant_url\n| extend avg_findings = round(avg_findings, 3)\n| order by metric_ts asc\n",
                "size": 0,
                "aggregation": 2,
                "title": "Findings Trend Over Time",
                "timeContextFromParameter": "time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart",
                "chartSettings": {
                    "showLegend": true,
                    "group": "domain_name"
                }
            },
            "name": "Findings Trend Over Time"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEPostureHistoryData_CL\r\n| where data_type == \"attack-paths\"\r\n| where domain_name in~ ({domain_name}) and tenant_url in~ ({bhe_tenant})\r\n| where metric_date {time}\r\n| extend metric_ts = todatetime(metric_date)\r\n| summarize avg_findings = avg(todouble(value)) by bin(metric_ts, 1d), domain_name, tenant_url\r\n| extend avg_findings = round(avg_findings, 3)\r\n| order by metric_ts asc\r\n",
                "size": 0,
                "title": "Total Attack Paths",
                "timeContextFromParameter": "time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart"
            },
            "name": "query - 4"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHEPostureHistoryData_CL\n| where data_type == \"assets\"\n| where domain_name in~ ({domain_name}) and tenant_url in~ ({bhe_tenant})\n| where metric_date {time}\n| extend metric_ts = todatetime(metric_date)\n| summarize avg_assets = avg(todouble(value)) by bin(metric_ts, 1d), domain_name, tenant_url\n| extend avg_assets = round(avg_assets, 3)\n| order by metric_ts asc\n",
                "size": 0,
                "aggregation": 2,
                "title": "Assets Trend Over Time",
                "timeContextFromParameter": "time",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "areachart",
                "chartSettings": {
                    "showLegend": true
                }
            },
            "name": "query - 4"
        }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-BloodHoundEnterprise",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}