{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "fcb0a2f6-3e6d-4ba0-a1a5-cb92acd33d35",
            "version": "KqlParameterItem/1.0",
            "name": "TimeGenerated",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let BaseData = WatchGuardFirebox\n| where isnotempty(SeverityLevel) and SeverityLevel != \"SeverityLevel\"\n| extend SeverityLabel = case(\n    SeverityLevel == \"info\", \"Information\",\n    SeverityLevel == \"debug\", \"Debugging\",\n    SeverityLevel == \"err\", \"Error\",\n    SeverityLevel == \"warn\", \"Warning\",\n    \"Other\"\n)\n| summarize Count = count() by SeverityLabel, bin(TimeGenerated, 1h)\n| summarize Trend = make_list(Count), Count = sum(Count) by SeverityLabel;\nlet TotalData = BaseData\n| summarize Trend = make_list(Count), Count = sum(Count)\n| extend SeverityLabel = \"All\";\nunion BaseData, TotalData\n",
        "size": 4,
        "title": "Event Severity Level Breakdown",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "SeverityLabel",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "lightBlue"
            }
          },
          "showBorder": true,
          "sortCriteriaField": "Count",
          "sortOrderField": 2
        }
      },
      "name": "Event Severity Level Breakdown"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(EventResult)\n| summarize TotalEvents = sum(toint(EventCount)) by EventResult\n",
        "size": 4,
        "title": "Event Result Breakdown",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "Event Result Breakdown"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where DvcAction != \"\"\n| summarize Count = count() by DvcAction\n",
        "size": 4,
        "title": "Action Types: Allow vs Deny",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "Action Types: Allow vs Deny"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(TimeGenerated)\n| summarize EventCount = count() by bin(TimeGenerated, {TimeGenerated:grain})\n| order by TimeGenerated asc\n",
        "size": 0,
        "title": "WatchGuard Event Volume OverTime",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "WatchGuard Event Volume (Hourly)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(FireboxManageUser)\n| summarize EventCount = count() by FireboxManageUser\n| top 10 by EventCount\n",
        "size": 0,
        "title": "Top Admin Users by Event Count",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top Admin Users by Event Count"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| summarize Count = count() by PolicyAction\n| top 10 by Count\n",
        "size": 0,
        "title": "Top Policy Actions",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top Policy Actions"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| summarize Count = count() by bin(TimeGenerated, 1h), EventResult\n| order by TimeGenerated asc\n",
        "size": 0,
        "title": "Success vs Failure Events Over Time",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "name": "Success vs Failure Events Over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(MessageId)\n| summarize Count = count() by MessageId\n| top 10 by Count\n",
        "size": 0,
        "title": "Frequent Message IDs",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Frequent Message IDs"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where DvcAction has \"block\" or EventResult == \"Failure\"\n| where isnotempty(DstIpAddr)\n| summarize BlockCount = count() by DstIpAddr\n| top 10 by BlockCount\n",
        "size": 0,
        "title": "Top Blocked Destination IPs",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Top Blocked Destination IPs"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(PolicyName)\n| summarize Count = count() by PolicyName\n| top 10 by Count\n",
        "size": 0,
        "title": "Most Triggered Firewall Policies",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "Most Triggered Firewall Policies"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(SrcGeoCountry)\n| summarize EventCount = count() by SrcGeoCountry\n| top 10 by EventCount\n",
        "size": 0,
        "title": "Top Source Countries",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Top Source Countries"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "WatchGuardFirebox\n| where isnotempty(SrcGeoCountry)\n| summarize Count = count() by SrcGeoCountry\n",
        "size": 0,
        "title": "Source IP Activity",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "map",
        "mapSettings": {
          "locInfo": "CountryRegion",
          "locInfoColumn": "SrcIpAddr",
          "latitude": "SrcIpAddr",
          "longitude": "SrcIpAddr",
          "sizeSettings": "Count",
          "sizeAggregation": "Sum",
          "legendMetric": "Count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "nodeColorField": "Count",
            "colorAggregation": "Sum",
            "type": "heatmap",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "customWidth": "50",
      "name": "Source IP Activity",
      "styleSettings": {
        "maxWidth": "100"
      }
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-WatchGuardFireboxWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}