{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Quokka Findings Dashboards (last 7d)"
      },
      "name": "workbook title"
    },
    {
      "type": 1,
      "content": {
        "json": "## Suspicious / Malicious findings"
      },
      "name": "malicious findings title"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "QscoutAppEvents_CL\n| where TimeGenerated > ago(7d)\n| where result_type == \"maliciousness\"\n| extend r = todynamic(results)\n| where isnotempty(r.entries)\n| mv-expand entry = r.entries\n| extend ruleId = tostring(entry.ruleId)\n| summarize count() by ruleId\n",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "ruleId",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "",
              "color": "blue"
            },
            {
              "seriesName": "malware/suspicious",
              "label": "Suspicious findings",
              "color": "orange"
            },
            {
              "seriesName": "malware/malicious",
              "label": "Malicious findings",
              "color": "red"
            },
            {
              "color": "lightBlue"
            }
          ]
        }
      },
      "name": "malicious findings chart"
    },
    {
      "type": 1,
      "content": {
        "json": "## SBOM findings (grouped by CVE ID with an averaged severity score)"
      },
      "name": "sbom findings title"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "QscoutAppEvents_CL\n| where TimeGenerated > ago(7d)\n| where result_type == \"sbom\"\n| extend r = todynamic(results)\n| where isnotempty(r.vulnerabilities)\n| mv-expand vulnerability = r.vulnerabilities\n| extend vulnId = tostring(vulnerability.id)\n| mv-expand rating = vulnerability.ratings\n| extend score = todouble(rating.score)\n| summarize avgScore = avg(score) by vulnId\n| order by avgScore desc\n",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "vulnId",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "createOtherGroup": 50
        }
      },
      "name": "sbom findings chart"
    },
    {
      "type": 1,
      "content": {
        "json": "## SARIF error-level findings"
      },
      "name": "sarif error-level findings"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "QscoutAppEvents_CL\n| where TimeGenerated > ago(7d)\n| where result_type == \"pattern\"\n| extend r = todynamic(results)\n| mv-expand findingKey = bag_keys(r.findings)\n| extend findingKey = tostring(findingKey)\n| extend finding = r.findings[findingKey]\n| extend category = findingKey,\n         errorCount = toint(finding.error.count)\n| summarize totalErrors = sum(errorCount) by category\n| project category, totalErrors\n",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "createOtherGroup": 25
        }
      },
      "name": "sarif error-level findings chart"
    },
    {
      "type": 1,
      "content": {
        "json": "## SARIF warning-level findings"
      },
      "name": "sarif warning-level findings"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "QscoutAppEvents_CL\n| where TimeGenerated > ago(7d)\n| where result_type == \"pattern\"\n| extend r = todynamic(results)\n| mv-expand findingKey = bag_keys(r.findings)\n| extend findingKey = tostring(findingKey)\n| extend finding = r.findings[findingKey]\n| extend category = findingKey,\n         warningCount = toint(finding.warning.count)\n| summarize totalWarnings = sum(warningCount) by category\n| project category, totalWarnings\n",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "createOtherGroup": 25
        }
      },
      "name": "sarif warning-level findings chart"
    }
  ],
  "fromTemplateId": "sentinel-QscoutWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}