{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**PingFederateEvent**](https://aka.ms/sentinel-PingFederate-parser) which is deployed with the Microsoft Sentinel Solution."
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "f7b02575-829c-435d-a4d3-251db9daf80e",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PingFederateEvent\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
        "size": 0,
        "title": "Events over time",
        "color": "greenDark",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "tileSettings": {
          "showBorder": false
        }
      },
      "customWidth": "65",
      "name": "query - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PingFederateEvent\r\n| where isnotempty(DstGeoCountry)\r\n| summarize count() by DstGeoCountry",
              "size": 3,
              "title": "Geo distribution",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "70",
            "name": "query - 0"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "PingFederateEvent\r\n| where isnotempty(DstUserName)\r\n| summarize u_users = dcount(DstUserName)",
                    "size": 3,
                    "title": "Users",
                    "timeContext": {
                      "durationMs": 0
                    },
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "card",
                    "gridSettings": {
                      "formatters": [
                        {
                          "columnMatch": "Unique Users",
                          "formatter": 1
                        }
                      ]
                    },
                    "textSettings": {
                      "style": "bignumber"
                    }
                  },
                  "name": "query - 0"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "PingFederateEvent\r\n| where isnotempty(SrcIpAddr)\r\n| summarize IPs = dcount(SrcIpAddr)",
                    "size": 3,
                    "title": "IP Addresses",
                    "timeContext": {
                      "durationMs": 0
                    },
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "card",
                    "textSettings": {
                      "style": "bignumber"
                    }
                  },
                  "name": "query - 1"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "PingFederateEvent\r\n| where isnotempty(DstGeoCountry)\r\n| summarize u_country = dcount(DstGeoCountry)",
                    "size": 3,
                    "title": "Countries",
                    "timeContext": {
                      "durationMs": 0
                    },
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "card",
                    "textSettings": {
                      "style": "bignumber"
                    }
                  },
                  "name": "query - 2"
                }
              ]
            },
            "customWidth": "30",
            "name": "group - 1"
          }
        ]
      },
      "customWidth": "35",
      "name": "group - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = PingFederateEvent\r\n| where isnotempty(EventType);\r\ndata\r\n| summarize Count = count() by EventType\r\n| join kind = inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventType)\r\n    on EventType\r\n\r\n\r\n\r\n\r\n",
              "size": 3,
              "title": "Event Types",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "EventType"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false
              }
            },
            "customWidth": "40",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PingFederateEvent\r\n| where isnotempty(SrcIpAddr)\r\n| summarize count() by SrcIpAddr\r\n| top 5 by count_",
              "size": 3,
              "title": "Top Sources",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "35",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PingFederateEvent\r\n| where isnotempty(DstUserName)\r\n| summarize ['Total Events'] = count() by DstUserName\r\n| top 10 by ['Total Events']",
              "size": 3,
              "title": "Top users",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "DstUserName",
                    "formatter": 4,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "Total Events",
                    "formatter": 4,
                    "formatOptions": {
                      "palette": "turquoise"
                    }
                  }
                ]
              }
            },
            "customWidth": "25",
            "name": "query - 2"
          }
        ]
      },
      "name": "group - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceProduct =~ \"PingFederate\"\r\n| order by TimeGenerated desc\r\n| extend Reason = extract(@'description=;?(\\w+),.*', 1, AdditionalExtensions)\r\n| where isnotempty(Reason)\r\n| project TimeGenerated, EventType = DeviceEventClassID, Reason",
        "size": 0,
        "title": "Latest errors",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "filter": true
        }
      },
      "name": "query - 5"
    }
  ],
  "fromTemplateId": "sentinel-PingFederateWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}