{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "query": "",
        "crossComponentResources": [],
        "parameters": [
          {
            "id": "49e2f511-592f-4d7f-8fda-d686803f3dbf",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          },
          {
            "id": "d54c1639-d46c-4655-9d76-d5416926a453",
            "version": "KqlParameterItem/1.0",
            "name": "WAF",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count=count() by Resource\r\n| order by Count desc, Resource asc\r\n| project Value = Resource, Lable = strcat(Resource, \" - \", Count)",
            "value": null,
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "All"
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "b1a1c99d-4498-4e02-82f0-d52c276d5657",
            "version": "KqlParameterItem/1.0",
            "name": "Events",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| summarize Count = count() by OperationName\r\n| order by Count desc, OperationName asc\r\n| project value = OperationName, Label = strcat(OperationName, ' - ', Count)",
            "value": null,
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "All"
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AzureDiagnostics\n| where ResourceType == \"APPLICATIONGATEWAYS\" \n| where \"{WAF:lable}\"==\"All\" or Resource in ({WAF})\n| where \"{Events:lable}\"==\"All\" or OperationName in ({Events})\n| summarize count() by Resource, TimeGenerated",
        "size": 1,
        "exportToExcelOptions": "visible",
        "title": "Resource events, by time",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Resource",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "customWidth": "70",
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\"\r\n| where \"{WAF:lable}\"==\"All\" or Resource in ({WAF})\r\n| where \"{Events:lable}\"==\"All\" or OperationName in ({Events})\r\n| summarize number = count() by Resource\r\n",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Resource use",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "30",
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"{WAF:lable}\"==\"All\" or Resource in ({WAF})\r\n| where \"{Events:lable}\"==\"All\" or OperationName in ({Events})\r\n| summarize number = count() by OperationName, TimeGenerated",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Firewall and access events, by time",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "70",
      "name": "query - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AzureDiagnostics\r\n| where ResourceType == \"APPLICATIONGATEWAYS\" \r\n| where \"{WAF:lable}\"==\"All\" or Resource in ({WAF})\r\n| where \"{Events:lable}\"==\"All\" or OperationName in ({Events})\r\n| summarize number = count() by OperationName",
        "size": 0,
        "exportToExcelOptions": "visible",
        "title": "Events, by operation",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "30",
      "name": "query - 6"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-WebApplicationFirewallOverview",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}