{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Cyble Vision Alerts\n---\n\nWorkbook to display and analyze Cyble Vision Alerts. This workbook visualize data that is retrived by the ```Cyble Vision Alerts``` CCF Data Connector.First connect the Cyble Vision Connector from Data Connector blade and then select CybleVisionAlerts_CL Logs table. ",
        "style": "info"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8e8c2f1a-d25d-49d1-a217-9831dbc4f919",
            "version": "KqlParameterItem/1.0",
            "name": "time_picker",
            "label": "Time Picker",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 604800000
            }
          },
          {
            "id": "f8d34a51-ba10-4241-abff-cb6c14b50a55",
            "version": "KqlParameterItem/1.0",
            "name": "log_table",
            "label": "Alerts Log Table",
            "type": 2,
            "isRequired": true,
            "query": "search \"*\" | summarize count() by $table | sort by count_ desc | where $table endswith \"CL\" | project $table",
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "time_picker",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": "CybleVisionAlerts_CL"
          },
          {
            "id": "89279a9c-af9e-4734-8a98-21aa1f2fa545",
            "version": "KqlParameterItem/1.0",
            "name": "Service",
            "label": "Alert Service",
            "type": 2,
            "description": "Filter alert rules you're looking at",
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "{log_table}\n| distinct Service",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 604800000
            },
            "timeContextFromParameter": "time_picker",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "web_applications"
            ]
          },
          {
            "id": "e9c5c651-ea8f-499e-8aa1-93faa1ae2eba",
            "version": "KqlParameterItem/1.0",
            "name": "AlertID",
            "label": "Select AlertID ",
            "type": 2,
            "query": "CybleVisionAlerts_CL\n| where Service contains {Service}\n| distinct ID",
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": "87574a9e-68c6-539c-a5e8-8b74f6baef8d"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let pService = {Service};\nlet pAlert   = '{AlertID}';\n\nCybleVisionAlerts_CL\n| where isempty(pService) or Service == pService\n| where isempty(pAlert) or ID == pAlert\n| extend ParsedData = parse_json(Data)\n| project TimeGenerated, ID, Service, Severity, Status, Description, ParsedData, Data\n| order by TimeGenerated desc\n",
        "size": 0,
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Data",
              "formatter": 2,
              "formatOptions": {
                "linkTarget": "CellDetails",
                "linkIsContextBlade": true
              }
            }
          ]
        },
        "tileSettings": {
          "titleContent": {},
          "rightContent": {
            "columnMatch": "ParsedData",
            "formatter": 2
          },
          "secondaryContent": {
            "columnMatch": "Data",
            "formatter": 2,
            "formatOptions": {
              "linkColumn": "Data",
              "linkTarget": "GenericDetails",
              "linkIsContextBlade": true
            }
          },
          "showBorder": false,
          "rowLimit": 100,
          "sortOrderField": 2
        }
      },
      "name": "query - 2"
    }
  ],
  "fallbackResourceIds": [
    "/subscriptions/34692849-4d09-4702-8aed-cfdb6e696cdb/resourcegroups/vision/providers/microsoft.operationalinsights/workspaces/pb-t3"
  ],
  "fromTemplateId": "sentinel-CybleVisionAlertsWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}