{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e9fc5159-d3fe-4011-8dd5-7ee37332612c", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientBrowser != '-' and isnotempty(ClientBrowser)\r\n| summarize Count = count() by ClientBrowser\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Browser Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Browser", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientDeviceType != '-' and isnotempty(ClientDeviceType)\r\n| summarize Count = count() by ClientDeviceType\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Device Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "DeviceName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 8", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Browser Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 13" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Device Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientBrowser == '{Browser}'\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {Browser}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Browser", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {Browser}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientDeviceType == '{DeviceName}'\r\n| sort by TimeGenerated desc\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {DeviceName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DeviceName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {DeviceName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientUsername != '-' and ClientMethod != '-' and isnotempty(ClientUsername) and isnotempty(ClientMethod)\r\n| summarize Count = count() by ['User Name'] = ClientUsername, Method = ClientMethod \r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Top Users By Access Method", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "User Name", "parameterName": "UserName", "parameterType": 1 }, { "fieldName": "Method", "parameterName": "Method", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 10", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientCloudApp !='-' and ClientUsername != '-' and isnotempty(ClientCloudApp) and isnotempty(ClientUsername)\r\n| summarize ['Total Client Bytes'] = sum(todecimal(ClientBytes)), ['Total Server Bytes'] = sum(todecimal(ServerBytes)) by Application = ClientCloudApp,['User Name'] = ClientUsername\r\n| sort by ['Total Client Bytes'] desc", "size": 0, "showAnalytics": true, "title": "Bytes Transferred", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Client Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } }, { "columnMatch": "Total Server Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Application", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Application", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 11", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top Users By Access Method' grid to view more details_" }, "customWidth": "50", "name": "text - 15" }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientUsername == '{UserName}' and ClientMethod == '{Method}'\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For User {UserName} and Method {Method}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "UserName", "comparison": "isNotEqualTo" }, { "parameterName": "Method", "comparison": "isNotEqualTo" } ], "name": "Web Transactions Details For User {UserName} and Method {Method}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where Site != '-' and isnotempty(Site)\r\n| summarize Count = count() by Site\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Top 10 Sites", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "SiteName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 12", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientHost != '-' and isnotempty(ClientHost)\r\n| summarize Count = count() by ClientHost\r\n| top 10 by Count\r\n", "size": 3, "showAnalytics": true, "title": "Top 10 Hosts", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "HostName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 13", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 Click on the above 'Top 10 Sites' pie chart to view more details" }, "customWidth": "50", "name": "text - 17" }, { "type": 1, "content": { "json": "💡 Click on the above 'Top 10 Hosts' pie chart to view more details" }, "customWidth": "50", "name": "text - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where Site == '{SiteName}'\r\n| sort by TimeGenerated desc\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {SiteName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SiteName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {SiteName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientHost == '{HostName}'\r\n| sort by TimeGenerated desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {HostName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "HostName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {HostName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where ClientTrafficType != '-' and isnotempty(ClientTrafficType)\r\n| summarize Count = count() by ClientTrafficType\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Client Traffic Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 18", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeCCFWebTransactions\r\n| where SSLPolicyCategories != '-' and isnotempty(SSLPolicyCategories)\r\n| extend Category = iff(SSLPolicyCategories contains \";\", split(SSLPolicyCategories,';'), split(SSLPolicyCategories,','))\r\n| mv-expand Category\r\n| extend Category = trim(\" \", tostring(Category))\r\n| summarize Count = count() by Category\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Policy Category Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 19", "styleSettings": { "showBorder": true } } ] }, "name": "Web Transactions Overview" } ], "fromTemplateId": "sentinel-Netskope CCF WebTx Dashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }