{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "388e603c-a5b1-40db-808f-d5dc5301793e",
            "version": "KqlParameterItem/1.0",
            "name": "time_range",
            "label": "TimeRange",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 259200000
            }
          },
          {
            "id": "e1c3e667-d431-419e-ae03-2da2f7f2d42f",
            "version": "KqlParameterItem/1.0",
            "name": "page",
            "label": "Page",
            "type": 1,
            "isGlobal": true,
            "isHiddenWhenLocked": true,
            "value": "main"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "global-parameters"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "30fe89ad-9eba-419e-8d9e-53c6805870db",
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Main",
            "subTarget": "main",
            "preText": "Main",
            "style": "link"
          },
          {
            "id": "5822aaf8-5ad8-49c6-acf8-491b439fbc1a",
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Threats",
            "subTarget": "threats",
            "style": "link"
          },
          {
            "id": "7266371b-70ac-4b79-abda-43169b26d760",
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Users",
            "subTarget": "users",
            "style": "link"
          },
          {
            "id": "3e007191-772f-48aa-8ac0-dfc9947f85c7",
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Assets",
            "subTarget": "assets",
            "style": "link"
          },
          {
            "id": "e585bed2-37bc-4bfe-8269-cd12726a8fe9",
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Devices",
            "subTarget": "devices",
            "style": "link"
          }
        ]
      },
      "name": "links - 6"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let days = dynamic([\"Sun\", \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\"]);\nlet months = dynamic([\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"]);\nunion isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\n| extend day_of_week = days[toint(dayofweek(AlertTime_t)/1d)]\n| extend month_of_year = months[getmonth(AlertTime_t)-1]\n| extend day_of_month = dayofmonth(AlertTime_t)\n| extend day_str = strcat(day_of_week, \" \", month_of_year, \" \", day_of_month)\n| extend day = todatetime(format_datetime(AlertTime_t, 'yyyy-MM-dd'))\n| summarize alert_count = count() by day, day_str, AlertSeverity_s\n| order by day asc, AlertSeverity_s\n| project Day = day_str, Alerts = alert_count, Severity = AlertSeverity_s",
              "size": 1,
              "showAnalytics": true,
              "title": "ALERTS OVER TIME",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "xAxis": "Day",
                "yAxis": [
                  "Alerts"
                ],
                "group": "Severity",
                "showLegend": true
              }
            },
            "name": "ALERTS OVER TIME - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\r\n| where  isnotempty( ThreatDetectionPolicyName_s)\r\n| summarize alerts_count = count() by ThreatDetectionPolicyName_s\r\n| project Threat = ThreatDetectionPolicyName_s, Alerts = alerts_count\r\n| take 4",
              "size": 0,
              "showAnalytics": true,
              "title": "TOP ALERTED THREAT MODELS",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Threat",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Alerts",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false,
                "sortCriteriaField": "Alerts",
                "sortOrderField": 2,
                "size": "full"
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "Alerts",
                "sizeAggregation": "Sum",
                "legendMetric": "Alerts",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "Alerts",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "customWidth": "50",
            "name": "TOP ALERTED THREAT MODELS"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\r\n| extend json_arr = parse_json(UserNames_s)\r\n| where  isnotempty(json_arr)\r\n| mv-expand json_arr\r\n| summarize alerts_count = count() by tostring(json_arr)\r\n| project User = json_arr, Alerts = alerts_count\r\n| take 4",
              "size": 0,
              "showAnalytics": true,
              "title": " TOP ALERTED USERS",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "User",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Alerts",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false,
                "sortCriteriaField": "Alerts",
                "sortOrderField": 2,
                "size": "full"
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "Alerts",
                "sizeAggregation": "Sum",
                "legendMetric": "Alerts",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "Alerts",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "customWidth": "50",
            "name": " TOP ALERTED USERS"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\r\n| extend json_arr = parse_json(Assets_s)\r\n| where  isnotempty(json_arr)\r\n| mv-expand json_arr\r\n| summarize alerts_count = count() by tostring(json_arr)\r\n| project Asset = json_arr, Alerts = alerts_count\r\n| take 4",
              "size": 0,
              "showAnalytics": true,
              "title": "TOP ALERTED ASSETS",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Asset",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Alerts",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false,
                "sortCriteriaField": "Alerts",
                "sortOrderField": 2,
                "size": "full"
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "Alerts",
                "sizeAggregation": "Sum",
                "legendMetric": "Alerts",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "Alerts",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "customWidth": "50",
            "name": "TOP ALERTED ASSETS"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\r\n| extend json_arr = parse_json(DeviceNames_s)\r\n| where  isnotempty(json_arr)\r\n| mv-expand json_arr\r\n| summarize alerts_count = count() by tostring(json_arr)\r\n| project Device = json_arr, Alerts = alerts_count\r\n| take 4",
              "size": 0,
              "showAnalytics": true,
              "title": "TOP ALERTED DEVICES",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Device",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Alerts",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false,
                "sortCriteriaField": "Alerts",
                "sortOrderField": 2,
                "size": "full"
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "Alerts",
                "sizeAggregation": "Sum",
                "legendMetric": "Alerts",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "Alerts",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "customWidth": "50",
            "name": "TOP ALERTED DEVICES"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "page",
        "comparison": "isEqualTo",
        "value": "main"
      },
      "name": "main-page"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let days = dynamic([\"Sun\", \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\"]);\nlet months = dynamic([\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"]);\nunion isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\n| extend day_of_week = days[toint(dayofweek(AlertTime_t)/1d)]\n| extend month_of_year = months[getmonth(AlertTime_t)-1]\n| extend day_of_month = dayofmonth(AlertTime_t)\n| extend day_str = strcat(day_of_week, \" \", month_of_year, \" \", day_of_month)\n| extend day = todatetime(format_datetime(AlertTime_t, 'yyyy-MM-dd'))\n| extend group_var = ThreatDetectionPolicyName_s\n| summarize alert_count = count() by day, day_str, group_var\n| order by day asc, group_var\n| project Day = day_str, Alerts = alert_count, Threat = group_var\n",
              "size": 1,
              "showAnalytics": true,
              "title": "THREAT MODEL NAMES",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "xAxis": "Day",
                "yAxis": [
                  "Alerts"
                ],
                "group": "Threat",
                "showLegend": true
              }
            },
            "name": "alerts-threats-day"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "page",
        "comparison": "isEqualTo",
        "value": "threats"
      },
      "name": "threats-page"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let days = dynamic([\"Sun\", \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\"]);\nlet months = dynamic([\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"]);\nunion isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\n| extend day_of_week = days[toint(dayofweek(AlertTime_t)/1d)]\n| extend month_of_year = months[getmonth(AlertTime_t)-1]\n| extend day_of_month = dayofmonth(AlertTime_t)\n| extend day_str = strcat(day_of_week, \" \", month_of_year, \" \", day_of_month)\n| extend day = todatetime(format_datetime(AlertTime_t, 'yyyy-MM-dd'))\n| extend json_arr = parse_json(UserNames_s)\n| where  isnotempty(json_arr)\n| mv-expand json_arr\n| extend group_var = tostring(json_arr)\n| summarize alert_count = count() by day, day_str, group_var\n| order by day asc, group_var\n| project Day = day_str, Alerts = alert_count, User = group_var",
              "size": 1,
              "showAnalytics": true,
              "title": "USERS",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "xAxis": "Day",
                "yAxis": [
                  "Alerts"
                ],
                "group": "User",
                "showLegend": true
              }
            },
            "name": "alerts-users-day"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "page",
        "comparison": "isEqualTo",
        "value": "users"
      },
      "name": "users-page"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let days = dynamic([\"Sun\", \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\"]);\nlet months = dynamic([\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"]);\nunion isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\n| extend day_of_week = days[toint(dayofweek(AlertTime_t)/1d)]\n| extend month_of_year = months[getmonth(AlertTime_t)-1]\n| extend day_of_month = dayofmonth(AlertTime_t)\n| extend day_str = strcat(day_of_week, \" \", month_of_year, \" \", day_of_month)\n| extend day = todatetime(format_datetime(AlertTime_t, 'yyyy-MM-dd'))\n| extend json_arr = parse_json(Assets_s)\n| where  isnotempty(json_arr)\n| mv-expand json_arr\n| extend group_var = tostring(json_arr)\n| summarize alert_count = count() by day, day_str, group_var\n| order by day asc, group_var\n| project Day = day_str, Alerts = alert_count, Asset = group_var",
              "size": 1,
              "showAnalytics": true,
              "title": "ASSETS",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "xAxis": "Day",
                "yAxis": [
                  "Alerts"
                ],
                "group": "Asset",
                "showLegend": true
              }
            },
            "name": "alerts-assets"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "page",
        "comparison": "isEqualTo",
        "value": "assets"
      },
      "name": "assets-page"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let days = dynamic([\"Sun\", \"Mon\", \"Tue\", \"Wed\", \"Thu\", \"Fri\", \"Sat\"]);\nlet months = dynamic([\"Jan\", \"Feb\", \"Mar\", \"Apr\", \"May\", \"Jun\", \"Jul\", \"Aug\", \"Sep\", \"Oct\", \"Nov\", \"Dec\"]);\nunion isfuzzy=true VaronisAlerts_CL, VaronisAlertsV2_CL\n| extend day_of_week = days[toint(dayofweek(AlertTime_t)/1d)]\n| extend month_of_year = months[getmonth(AlertTime_t)-1]\n| extend day_of_month = dayofmonth(AlertTime_t)\n| extend day_str = strcat(day_of_week, \" \", month_of_year, \" \", day_of_month)\n| extend day = todatetime(format_datetime(AlertTime_t, 'yyyy-MM-dd'))\n| extend json_arr = parse_json(DeviceNames_s)\n| where  isnotempty(json_arr)\n| mv-expand json_arr\n| extend group_var = tostring(json_arr)\n| summarize alert_count = count() by day, day_str, group_var\n| order by day asc, group_var\n| project Day = day_str, Alerts = alert_count, Device = group_var\n",
              "size": 1,
              "showAnalytics": true,
              "title": "DEVICES",
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "xAxis": "Day",
                "yAxis": [
                  "Alerts"
                ],
                "group": "Device",
                "showLegend": true
              }
            },
            "name": "alerts-devices-day"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "page",
        "comparison": "isEqualTo",
        "value": "devices"
      },
      "name": "devices-page"
    }
  ],
  "fromTemplateId": "https://sentinelus.hosting.portal.azure.net/sentinelus/Content/1.0.02484.3403-231021-003920/Scenarios/Ecosystem/Content/Workbooks/CustomWorkbook.json",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}