{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "ef4b7784-4a48-459d-b7d9-020f8cb11ff7",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2419200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "d5a9d38f-535c-4da7-8595-de01edab6f67",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Overview",
            "subTarget": "Overview",
            "style": "link"
          },
          {
            "id": "62da78b4-9094-45e8-a68e-794c9cbe0b96",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Authentication",
            "subTarget": "Authentication",
            "style": "link"
          },
          {
            "id": "e13d1dfa-1c71-4500-ab71-0ec3e0834361",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Administrator",
            "subTarget": "Administrator",
            "style": "link"
          },
          {
            "id": "782eadd4-6a13-407e-8dc0-e49ac73ff214",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Telephony",
            "subTarget": "Telephony",
            "style": "link"
          },
          {
            "id": "18019294-be9a-430a-8cd6-f765a246e8be",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Offline Enrollment",
            "subTarget": "OfflineEnrollment",
            "style": "link"
          },
          {
            "id": "3023775f-ab50-49b9-8e92-f7bb73eb8c9e",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Trust Monitor",
            "subTarget": "TrustMonitor",
            "style": "link"
          }
        ]
      },
      "name": "links - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize Count = dcount(email_s)",
        "size": 3,
        "title": "Active Users",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {},
          "rightContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            }
          },
          "showBorder": false,
          "size": "auto"
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Overvie"
      },
      "customWidth": "50",
      "name": "query - 2",
      "styleSettings": {
        "maxWidth": "33%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where event_type_s == \"enrollment\"\r\n| summarize Count = dcount(email_s)",
        "size": 3,
        "title": "Enrollments",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {},
          "rightContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            }
          },
          "showBorder": false,
          "size": "auto"
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Overview"
      },
      "customWidth": "50",
      "name": "query - 3",
      "styleSettings": {
        "maxWidth": "33%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where factor_s == \"bypass_code\"\r\n| summarize Count = dcount(email_s)",
        "size": 3,
        "title": "Bypass Code Authentications",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {},
          "rightContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            }
          },
          "showBorder": false
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Overview"
      },
      "customWidth": "50",
      "name": "query - 4",
      "styleSettings": {
        "maxWidth": "33%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where result_s == \"fraud\"\r\n| sort by TimeGenerated desc\r\n| project Date = isotimestamp_t, User = user_name_s, IPAddress = access_device_ip_s, Application = application_name_s, 2FAFactor = factor_s",
        "size": 3,
        "title": "Fraud Reports",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo"
      },
      "name": "query - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where event_type_s == \"authentication\" and result_s == \"success\"\r\n| extend factor = iff(isempty(factor_s), reason_s, factor_s)\r\n| where factor != \"None\" and isnotempty(factor)\r\n| summarize count() by factor\r\n",
        "size": 3,
        "title": "Successful Authentications by Factor",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Overview"
      },
      "customWidth": "50",
      "name": "query - 6",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where event_type_s == \"authentication\" and result_s == \"failure\"\r\n| extend factor = iff(isempty(factor_s), reason_s, factor_s)\r\n| where factor != \"None\" and isnotempty(factor)\r\n| summarize count() by reason_s\r\n",
        "size": 3,
        "title": "Reasons for Failed Authentications",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Over"
      },
      "customWidth": "50",
      "name": "query - 7",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where result_s == \"fraud\"\r\n| sort by TimeGenerated desc\r\n| project Date = isotimestamp_t, User = user_name_s, IPAddress = access_device_ip_s, Application = application_name_s, 2FAFactor = factor_s",
        "size": 3,
        "title": "Fraud Reports",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where result_s == \"failure\"\r\n| extend factor = iff(isempty(factor_s), reason_s, factor_s)\r\n| where factor != \"None\" and isnotempty(factor)\r\n| summarize count() by reason_s",
        "size": 3,
        "title": "Reasons for Failed Authentications",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where factor_s == \"Duo Push\" and result_s == \"success\"\r\n| extend factor = iff(isempty(factor_s), reason_s, factor_s)\r\n| where factor != \"None\"\r\n| summarize count() by bin(isotimestamp_t, 1h)",
        "size": 2,
        "title": "Successful Duo Pushes",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 10"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where result_s == \"success\"\r\n| extend factor = iff(isempty(factor_s), reason_s, factor_s)\r\n| where factor != \"None\" and isnotempty(factor)\r\n| summarize count() by factor",
        "size": 0,
        "title": "Successful Authentications by Factor",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value};\r\nDuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize Total = count(), Success = countif(result_s == \"success\"), Failure= countif(result_s == \"failure\"), Error= countif(result_s == \"error\"), Fraud= countif(result_s == \"fraud\") by application_name_s\r\n| join kind=inner \r\n  (\r\n    data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by application_name_s\r\n    | project-away TimeGenerated\r\n  ) on application_name_s\r\n| project Application = application_name_s, Success, Failure, Error, Fraud, Total, Trend\r\n| sort by Total desc",
        "size": 0,
        "title": "Most Active Applications",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where result_s == \"success\"\r\n| summarize count() by reason_s",
        "size": 0,
        "title": "Reasons for Successful Authentications",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 14"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize count() by result_s, bin(TimeGenerated, {TimeRange:grain})",
        "size": 3,
        "title": "Authentications over Time by Result",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 15"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAuthentication_CL\r\n| where TimeGenerated {TimeRange:value}",
        "size": 3,
        "title": "Authentication Locations by Country",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "map",
        "mapSettings": {
          "locInfo": "CountryRegion",
          "locInfoColumn": "access_device_location_country_s",
          "sizeSettings": "result_s",
          "sizeAggregation": "Count",
          "legendMetric": "reason_s",
          "legendAggregation": "Count",
          "itemColorSettings": {
            "nodeColorField": "timestamp_d",
            "colorAggregation": "Sum",
            "type": "heatmap",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "query - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize count () by action_s, bin(TimeGenerated, {TimeRange:grain})",
        "size": 3,
        "title": "Administrator Actions",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "action_s"
          },
          "showBorder": false
        },
        "graphSettings": {
          "type": 0
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 16"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s == \"admin_update\"\r\n| project Date = isotimestamp_t, Object = object_s, Modifier = username_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recently Updated Admins",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 17"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s == \"admin_create\"\r\n| project Date = isotimestamp_t, Object = object_s, Modifier = username_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recently Created Admins",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 17 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s contains \"ad_sync\"\r\n| project Date = isotimestamp_t, User = username_s, Task = action_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recent AD Sync Events",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 17 - Copy - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s contains \"directory\"\r\n| project Date = isotimestamp_t, User = username_s, Task = action_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recent Directory Events",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 20"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s contains \"group\"\r\n| project Date = isotimestamp_t, User = username_s, Task = action_s, Group = object_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recent Group Events",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 21"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s contains \"hardtoken\"\r\n| project Date = isotimestamp_t, User = username_s, Task = action_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recent Hard Token Events",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 22"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityAdministrator_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where action_s contains \"integration\"\r\n| project Date = isotimestamp_t, User = username_s, Task = action_s\r\n| sort by Date desc",
        "size": 0,
        "title": "Recent Application Events",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Administrator"
      },
      "name": "query - 23"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityTelephony_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize sum(credits_d)",
        "size": 3,
        "title": "Credits Used",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "card",
        "tileSettings": {
          "showBorder": false
        },
        "textSettings": {
          "style": "bignumber"
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Telephony"
      },
      "customWidth": "50",
      "name": "query - 24",
      "styleSettings": {
        "maxWidth": "25%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityTelephony_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize sum(credits_d) by Type = type_s",
        "size": 3,
        "title": "Credits Used by Type",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Telephony"
      },
      "customWidth": "50",
      "name": "query - 25",
      "styleSettings": {
        "maxWidth": "75%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityTelephony_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize Credits = sum(credits_d) by Context = context_s",
        "size": 3,
        "title": "Credits Used by Context",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Telephony"
      },
      "name": "query - 26"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityOfflineEnrollment_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| project Time = isotimestamp_t, Action = action_s, User = username_s, Object = object_s",
        "size": 0,
        "title": "Recent Offline Enrollments",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OfflineEnrollment"
      },
      "name": "query - 27"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityOfflineEnrollment_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| summarize count() by Action = action_s",
        "size": 3,
        "title": "Offline Enrollments by Action",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OfflineEnrollment"
      },
      "name": "query - 28"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DuoSecurityTrustMonitor_CL\r\n| where TimeGenerated {TimeRange:value}\r\n| where isnotempty(triage_event_uri_s)\r\n| project Time = surfaced_auth_isotimestamp_t, State = state_s, Uri = triage_event_uri_s",
        "size": 0,
        "title": "Recent Trust Monitor Events",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Uri",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url"
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "TrustMonitor"
      },
      "name": "query - 29"
    }
  ],
  "fromTemplateId": "sentinel-DuoSecurity",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}