{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## CrowdStrike Falcon Endpoint Protection Overview\nUse this workbook to review authentication activity, detections, and high-risk endpoint events. The views below are driven by the workbook parameters so analysts can quickly focus on specific hosts, users, tactics, and time ranges."
      },
      "name": "introduction"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "5f6ef388-eba8-456d-a86d-b0e5d13753dc",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 7776000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "e75aea48-9de8-48ca-8420-93fcdda9b996",
            "cellValue": "TabName",
            "linkTarget": "parameter",
            "linkLabel": "Detections",
            "subTarget": "Detections",
            "style": "link"
          },
          {
            "id": "e06768ad-90d3-49d2-aa55-bac601c19769",
            "cellValue": "TabName",
            "linkTarget": "parameter",
            "linkLabel": "Authentication",
            "subTarget": "Authentication",
            "style": "link"
          }
        ]
      },
      "name": "links - 7"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "28302220-bac7-4011-bd0b-b8565627887e",
            "version": "KqlParameterItem/1.0",
            "name": "Operation",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| distinct Activity\r\n| sort by Activity asc",
            "value": null,
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "94066942-9782-41b5-b60d-4ea12fda9a28",
            "version": "KqlParameterItem/1.0",
            "name": "TargetUserName",
            "label": "Target User",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| distinct DstUserName\r\n| sort by DstUserName asc",
            "value": null,
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "name": "parameters - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| where Activity in ({Operation}) or '*' in ({Operation})\r\n| where DstUserName in ({TargetUserName}) or '*' in ({TargetUserName})\r\n| summarize Total = count() by Activity, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Operation over Time",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_0"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "customWidth": "75",
      "name": "Total Events by Operation over Time"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "4d809240-d4ee-4266-adc0-cb05344a2f5a",
            "version": "KqlParameterItem/1.0",
            "name": "Hostnames",
            "label": "Hostname",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| distinct DstHostName\r\n| sort by DstHostName asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "version": "KqlParameterItem/1.0",
            "name": "Usernames",
            "label": "Username",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| distinct DstUserName\r\n| sort by DstUserName asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "id": "3be22ee0-2638-4205-bfb4-ba56f9baee92"
          },
          {
            "version": "KqlParameterItem/1.0",
            "name": "Tactics",
            "label": "Tactic",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| distinct Activity\r\n| sort by Activity asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 604800000
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "id": "6c37e6c7-3704-4a9c-a10c-227c1d46b694"
          },
          {
            "version": "KqlParameterItem/1.0",
            "name": "SensorId",
            "label": "Sensor ID",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| distinct SensorId\r\n| sort by SensorId asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "id": "6e7adfa5-99de-4a23-bf94-2322beee79f1"
          },
          {
            "version": "KqlParameterItem/1.0",
            "name": "Severity",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| distinct Severity\r\n| sort by Severity asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "id": "e3a85e7b-f5ed-43d6-a398-fc1a20bb42f7"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "name": "parameters - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "## How to use this workbook\nStart with the summary tiles and trend charts, then drill into the tables for critical detections, failed events, and top hosts/users. Adjust the parameters at the top of the workbook to narrow the scope of investigation."
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "name": "text - 17"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize ['Total Detections'] = count() by EventType",
        "size": 4,
        "showAnalytics": true,
        "title": "Total Detections",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Total Detections",
            "formatter": 12,
            "formatOptions": {
              "palette": "none"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "useGrouping": false,
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_1"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "30",
      "name": "Total Detections"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = dcount(SensorId) by EventType",
        "size": 4,
        "showAnalytics": true,
        "title": "Number of Sensors",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Total",
            "formatter": 12,
            "formatOptions": {
              "palette": "none"
            },
            "numberFormat": {
              "unit": 0,
              "options": {
                "style": "decimal",
                "useGrouping": false,
                "maximumFractionDigits": 0
              }
            }
          },
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_2"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "30",
      "name": "Number of Sensors"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Severity",
        "size": 4,
        "showAnalytics": true,
        "title": "Detection by Severity",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "High",
              "color": "redDark"
            },
            {
              "seriesName": "Medium",
              "color": "orange"
            },
            {
              "seriesName": "Low",
              "color": "blue"
            },
            {
              "seriesName": "Critical",
              "color": "redBright"
            }
          ]
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_0"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "40",
      "name": "Detection by Severity"
    },
    {
      "type": 1,
      "content": {
        "json": "___"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "name": "text - 17 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| where Severity == \"Critical\"\r\n| summarize Total = count() by TimeGenerated, Severity, DstHostName, DstUserName, Activity, Technique, Message\r\n| sort by TimeGenerated desc\r\n",
        "size": 1,
        "showAnalytics": true,
        "title": "Critical Severity Events",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_1"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "name": "Critical Severity Events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Hostname = DstHostName, ['IP Address'] = SrcIpAddr, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Detections by Host over Time",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_2"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "60",
      "name": "Total Detections by Host over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Hostname = DstHostName, ['IP Address'] = SrcIpAddr\r\n| top 10 by Total desc\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 Hosts",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "40",
      "name": "Top 10 Hosts"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| where Activity in ({Operation}) or '*' in ({Operation})\r\n| where DstUserName in ({TargetUserName}) or '*' in ({TargetUserName})\r\n| summarize Total = count() by Activity\r\n| sort by Total desc",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Operation",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": true,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "customWidth": "25",
      "name": "Total Events by Operation"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| where Activity in ({Operation}) or '*' in ({Operation})\r\n| where DstUserName in ({TargetUserName}) or '*' in ({TargetUserName})\r\n| where Outcome == \"false\"\r\n| summarize Total = count() by TimeGenerated, Activity, ['Target Username'] = DstUserName, ['IP Address'] =  DstIpAddr\r\n| sort by TimeGenerated desc",
        "size": 0,
        "showAnalytics": true,
        "title": "Failed Events",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": true,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "customWidth": "100",
      "name": "Failed Events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| where Activity in ({Operation}) or '*' in ({Operation})\r\n| where DstUserName in ({TargetUserName}) or '*' in ({TargetUserName})\r\n| where Outcome == \"false\"\r\n| summarize Total = count() by User = DstUserName\r\n| sort by Total desc",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Failed Events by User",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": true,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "customWidth": "50",
      "name": "Total Failed Events by User"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"AuthActivityAuditEvent\"\r\n| where Activity in ({Operation}) or '*' in ({Operation})\r\n| where DstUserName in ({TargetUserName}) or '*' in ({TargetUserName})\r\n| where Outcome == \"false\"\r\n| summarize Total = count() by ['IP Address'] = DstIpAddr\r\n| sort by Total desc",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Failed Events by IP Address",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": true,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Authentication"
      },
      "customWidth": "50",
      "name": "Total Failed Events by IP Address"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by DstUserName, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Detections by User over Time",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "60",
      "name": "Total Detections by User over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Username = DstUserName\r\n| top 10 by Total desc\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 Users",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "40",
      "name": "Top 10 Users"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by FileName, FilePath, Tactic = Activity\r\n| top 10 by Total desc\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "File-Based Detections",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "filter": true,
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "60",
      "name": "File-Based Detections"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by FileName, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "File-Based Detections over Time",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar",
        "gridSettings": {
          "filter": true,
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "40",
      "name": "File-Based Detections over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Activity, bin(TimeGenerated, {TimeRange:grain})\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Detections by Tactics over Time",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "unstackedbar",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "60",
      "name": "Total Detections by Tactics over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CrowdStrikeFalconEventStream\r\n| where EventType == \"DetectionSummaryEvent\"\r\n| where DstHostName in ({Hostnames}) or '*' in ({Hostnames})\r\n| where DstUserName in ({Usernames}) or '*' in ({Usernames})\r\n| where Activity in ({Tactics}) or '*' in ({Tactics})\r\n| where SensorId in ({SensorId}) or '*' in ({SensorId})\r\n| where Severity in ({Severity}) or '*' in ({Severity})\r\n| summarize Total = count() by Activity\r\n| top 10 by Total desc\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Detections by Tactics",
        "timeContext": {
          "durationMs": 7776000000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false,
                  "maximumFractionDigits": 2
                }
              }
            }
          ],
          "showExportToExcel": true
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Activity",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Total",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "Detections"
      },
      "customWidth": "40",
      "name": "Detections by Tactics"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-CrowdStrikeFalconEndpointProtection",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}