{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "82fedb33-961a-4199-a5ab-16340948ed10",
            "version": "KqlParameterItem/1.0",
            "name": "time_range",
            "label": "time range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "#### Audit & Authentication Events by Category",
        "style": "info"
      },
      "name": "text - 19"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastAudit_CL\n| summarize count() by Category, bin(TimeGenerated, 1h)",
        "size": 3,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "auditType_s",
            "formatter": 1
          },
          "subtitleContent": {
            "columnMatch": "count_"
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "showBorder": true,
          "sortCriteriaField": "auditType_s",
          "size": "auto"
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "auditType_s",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "group": "Category",
          "createOtherGroup": 0,
          "seriesLabelSettings": [
            {
              "seriesName": "reporting_logs",
              "label": "Reporting "
            },
            {
              "seriesName": "authentication_logs",
              "label": "Authentication"
            },
            {
              "seriesName": "case_review_logs",
              "label": "Case Review"
            },
            {
              "seriesName": "account_logs",
              "label": "Account"
            },
            {
              "seriesName": "profile_group_logs",
              "label": "Profile Group"
            },
            {
              "seriesName": "user_account_and_role_logs",
              "label": "User Account and Roles"
            },
            {
              "seriesName": "mimecast_access_logs",
              "label": "Mimecast Acess"
            },
            {
              "seriesName": "archive_service_logs",
              "label": "Archive Service"
            },
            {
              "seriesName": "policy_logs",
              "label": "Policy "
            },
            {
              "seriesName": "awareness_training_logs",
              "label": "Awareness Training"
            },
            {
              "seriesName": "secure_messaging_logs",
              "label": "Secure Messaging"
            },
            {
              "seriesName": "integrations_and_apis",
              "label": "Integrations and API's"
            }
          ]
        }
      },
      "name": "query - 18"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Audit Events by Type",
                    "style": "info"
                  },
                  "name": "text - 16"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 2,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 10
                    }
                  },
                  "name": "query - 15"
                }
              ]
            },
            "customWidth": "33",
            "name": "Audit Events",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Account Events",
                    "style": "info"
                  },
                  "name": "text - 3"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where mimecastEventId_s == \"audit_account\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 20
                    }
                  },
                  "name": "query - 4"
                }
              ]
            },
            "customWidth": "33",
            "name": "Account Events",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Authentication Events",
                    "style": "info"
                  },
                  "name": "text - 5"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where mimecastEventId_s == \"audit_authentication\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 10
                    }
                  },
                  "name": "query - 6"
                }
              ]
            },
            "customWidth": "33",
            "name": "Authentication Events",
            "styleSettings": {
              "maxWidth": "33%"
            }
          }
        ]
      },
      "name": "group - 17"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Mimecast Support Access Events",
                    "style": "info"
                  },
                  "name": "text - 7"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where mimecastEventId_s == \"audit_mimecast_access\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": []
                  },
                  "name": "query - 8"
                }
              ]
            },
            "customWidth": "33",
            "name": "Mimecast Support",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Archive Service Events",
                    "style": "info"
                  },
                  "name": "text - 9"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where mimecastEventId_s == \"audit_archive_service\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 10"
                }
              ]
            },
            "customWidth": "33",
            "name": "Archive Service Events",
            "styleSettings": {
              "maxWidth": "33%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### User Account and Role Events",
                    "style": "info"
                  },
                  "name": "text - 11"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n//| distinct auditType_s, mimecastEventId_s, mimecastEventCategory_s\n| where mimecastEventId_s == \"audit_user_account_and_role\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 12"
                }
              ]
            },
            "customWidth": "33",
            "name": "User Account and Role Events",
            "styleSettings": {
              "maxWidth": "33%"
            }
          }
        ]
      },
      "name": "group - 12"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Policy Events",
                    "style": "info"
                  },
                  "name": "text - 13"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where mimecastEventId_s == \"audit_policy\"\n| summarize count() by auditType_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "timeContextFromParameter": "time_range",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "sortBy": [],
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 14"
                }
              ]
            },
            "customWidth": "50",
            "name": "group - 2",
            "styleSettings": {
              "maxWidth": "50%"
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "#### Successful Logins by Application",
                    "style": "info"
                  },
                  "name": "text - 7"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "MimecastAudit_CL\n| where app_s !=\"\"\n| summarize count() by app_s, bin(TimeGenerated, 1h)",
                    "size": 3,
                    "timeContext": {
                      "durationMs": 86400000
                    },
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "createOtherGroup": 0
                    }
                  },
                  "name": "query - 8"
                }
              ]
            },
            "customWidth": "50",
            "name": "group - 1",
            "styleSettings": {
              "maxWidth": "50%"
            }
          }
        ]
      },
      "name": "group - 13"
    },
    {
      "type": 1,
      "content": {
        "json": "#### Failed Logins by User, App and Source IP",
        "style": "info"
      },
      "name": "text - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastAudit_CL\n| where src_s !=\"unknown\" and auditType_s == \"Logon Authentication Failed\"\n| summarize count() by user_s, app_s, src_s, bin(TimeGenerated, 1h)",
        "size": 0,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "labelSettings": [
            {
              "columnId": "user_s",
              "label": "User"
            },
            {
              "columnId": "app_s",
              "label": "App"
            },
            {
              "columnId": "src_s",
              "label": "Source IP"
            },
            {
              "columnId": "count_",
              "label": "Faild Logins"
            }
          ]
        }
      },
      "name": "query - 14"
    },
    {
      "type": 1,
      "content": {
        "json": "#### Successful Logins by User, App and Source IP",
        "style": "info"
      },
      "name": "text - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MimecastAudit_CL\n| where src_s !=\"unknown\" and auditType_s == \"User Logged On\"\n| summarize count() by user_s, app_s, src_s, bin(TimeGenerated, 1h)",
        "size": 0,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "labelSettings": [
            {
              "columnId": "user_s",
              "label": "User"
            },
            {
              "columnId": "app_s",
              "label": "App"
            },
            {
              "columnId": "src_s",
              "label": "Source IP"
            },
            {
              "columnId": "count_",
              "label": "Successful Logins"
            }
          ]
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "user_s",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "user_s",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "count_",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "createOtherGroup": 0
        },
        "mapSettings": {
          "locInfo": "AzureResource",
          "locInfoColumn": "src_s",
          "sizeAggregation": "Count",
          "legendMetric": "count_",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "nodeColorField": "count_",
            "colorAggregation": "Sum",
            "type": "thresholds",
            "thresholdsGrid": [
              {
                "operator": "Default",
                "thresholdValue": null,
                "representation": "blue"
              }
            ]
          }
        }
      },
      "name": "query - 12"
    }
  ],
  "fromTemplateId": "sentinel-MimecastAudit",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}