{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "91698dfb-6494-47f8-8789-44d47c9bb60a",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2419200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "resourceType": "microsoft.insights/components"
          },
          {
            "id": "96ede67e-4a1d-4207-9771-a286c41203f7",
            "version": "KqlParameterItem/1.0",
            "name": "VPNDevice",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "PulseConnectSecure\r\n| distinct tostring(Computer)",
            "value": null,
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "label": "VPN Device"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| extend LoginResults = extract(\"^Login (failed|succeeded)\", 1, Messages)\r\n| where isnotempty(LoginResults)\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| summarize dcount(User) by Computer, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "title": "Distinct User Login by VPN Device",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| extend LoginResults = extract(\"^Login (failed|succeeded)\", 1, Messages)\r\n| where isnotempty(LoginResults)\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where User !endswith \"$\" and User !~ \"SYSTEM\"\r\n| summarize count() by LoginResults, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "title": "User Login Events by Time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "succeeded",
              "color": "green"
            },
            {
              "seriesName": "failed",
              "color": "red"
            }
          ],
          "xSettings": {},
          "ySettings": {}
        }
      },
      "customWidth": "50",
      "name": "query - 11 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| extend LoginResults = extract(\"^Login (failed|succeeded)\", 1, Messages)\r\n| where isnotempty(LoginResults)\r\n| where LoginResults == \"failed\"\r\n| where User !endswith \"$\" and User !~ \"SYSTEM\"\r\n| summarize count() by User, Source_IP\r\n| top 10 by count_\r\n",
        "size": 0,
        "title": "Top 10 Failed Login by User",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "count_",
              "formatter": 3,
              "formatOptions": {
                "palette": "coldHot"
              }
            }
          ],
          "labelSettings": [
            {
              "columnId": "User",
              "label": "VPN User"
            },
            {
              "columnId": "Source_IP",
              "label": "Client IP"
            },
            {
              "columnId": "count_",
              "label": "Total"
            }
          ]
        },
        "sortBy": []
      },
      "customWidth": "50",
      "name": "query - 11 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| extend LoginResults = extract(\"^Login (failed|succeeded)\", 1, Messages)\r\n| where isnotempty(LoginResults)\r\n| where LoginResults == \"failed\"\r\n| where User !endswith \"$\" and User !~ \"SYSTEM\"\r\n| summarize count() by Realm, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "title": "Top 10 Failed Login by User Realm",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "query - 11 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| extend LoginResults = extract(\"^Login (failed|succeeded)\", 1, Messages)\r\n| where isnotempty(LoginResults)\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where LoginResults == \"failed\"\r\n| where User !endswith \"$\" and User != \"SYSTEM\"\r\n| summarize count() by Computer, bin(TimeGenerated, {TimeRange:grain})\r\n| top 10 by count_\r\n",
        "size": 0,
        "title": "Top 10 Failed Login by VPN Device",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "customWidth": "50",
      "name": "query - 11 - Copy - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where Messages has \"Host Checker\"\r\n| extend OS = case(Messages has \"Mac\", \"Mac OSX\", Messages has \"Windows\", \"Windows\",\"Other\")\r\n| summarize count() by OS",
        "size": 0,
        "title": "Client Device Usage",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| summarize ADPrimaryAuthSuccess = countif(Messages has \"Primary authentication successful\"), ADPrimaryAuthFailed = countif(Messages has \"Primary authentication failed\"), ADsecondaryAuthSuccess =countif(Messages has \"Secondary authentication successful\"), ADSecondaryAuthFailed = countif(Messages has \"Secondary authentication failed\")",
        "size": 0,
        "title": "Active Directory Authentication Status",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "customWidth": "50",
      "name": "query - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where Messages has \"User Accounts modified\"\r\n| summarize UserAdded = countif(Messages has \"Added with username\"), UserRemoved = countif(Messages has \"Removed username\")\r\n",
        "size": 0,
        "title": "User Modification Status by Count",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar"
      },
      "customWidth": "50",
      "name": "query - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PulseConnectSecure\r\n| where Computer in ({VPNDevice}) or '*' in ({VPNDevice})\r\n| where Messages contains \"Radius Accounting\"\r\n| summarize ['Auth Success'] = countif(Messages has \"Failed to send radius\"), ['Auth Failed']=countif(Messages has \"Successfully sent radius\") by bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "title": "RADIUS Authentication Result by Time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "customWidth": "50",
      "name": "query - 10"
    }
  ],
  "fromTemplateId": "sentinel-PulseConnectSecure",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}