{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Netskope Web Transactions\n---\nThis workbook provides comprehensive visibility into web traffic monitored by Netskope, including user activity, application usage, traffic patterns, threat protection, endpoint posture, process activity, identity, and security insights."
      },
      "name": "workbook-header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "a2b5c6d7-1234-5678-9abc-def012345678",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 86400000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 1,
      "content": {
        "json": "## User Activity"
      },
      "name": "user-activity-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsUsername) and CsUsername != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueApps = dcount(XCsApp),\n    UniqueHosts = dcount(CsHost),\n    TotalBytes = sum(Bytes)\n    by User = CsUsername\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top 20 Active Users",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "TotalBytes",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-users"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsUsername) and CsUsername != \"-\"\n| summarize Transactions = count() by User = CsUsername\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Top 10 Users by Transactions",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "top-users-pie"
    },
    {
      "type": 1,
      "content": {
        "json": "## Applications & Categories"
      },
      "name": "apps-categories-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsApp) and XCsApp != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueUsers = dcount(CsUsername),\n    TotalBytes = sum(Bytes)\n    by Application = XCsApp\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top 20 Applications",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "TotalBytes",
              "formatter": 4,
              "formatOptions": {
                "palette": "turquoise"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-applications"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCategory) and XCategory != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueUsers = dcount(CsUsername),\n    TotalBytes = sum(Bytes)\n    by Category = XCategory\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top 20 Web Categories",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "purple"
              }
            },
            {
              "columnMatch": "TotalBytes",
              "formatter": 4,
              "formatOptions": {
                "palette": "magenta"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-categories"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsApp) and XCsApp != \"-\"\n| summarize Transactions = count() by Application = XCsApp\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Application Distribution",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "app-distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCategory) and XCategory != \"-\"\n| summarize Transactions = count() by Category = XCategory\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Category Distribution",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "category-distribution"
    },
    {
      "type": 1,
      "content": {
        "json": "## Geographic Analysis"
      },
      "name": "geo-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCCountry) and XCCountry != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueUsers = dcount(CsUsername)\n    by SourceCountry = XCCountry\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Traffic by Source Country",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "source-country"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XSCountry) and XSCountry != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueHosts = dcount(CsHost)\n    by DestCountry = XSCountry\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Traffic by Destination Country",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "dest-country"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCLocation) and XCLocation != \"-\"\n| summarize Transactions = count() by Location = XCLocation\n| order by Transactions desc\n| take 15",
        "size": 0,
        "title": "Top Source Locations",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "source-locations"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XSLocation) and XSLocation != \"-\"\n| summarize Transactions = count() by Location = XSLocation\n| order by Transactions desc\n| take 15",
        "size": 0,
        "title": "Top Destination Locations",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "dest-locations"
    },
    {
      "type": 1,
      "content": {
        "json": "## HTTP Status & Methods"
      },
      "name": "http-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where ScStatus > 0\n| summarize Transactions = count() by StatusCode = tostring(ScStatus)\n| extend StatusCategory = case(\n    toint(StatusCode) >= 200 and toint(StatusCode) < 300, \"2xx Success\",\n    toint(StatusCode) >= 300 and toint(StatusCode) < 400, \"3xx Redirect\",\n    toint(StatusCode) >= 400 and toint(StatusCode) < 500, \"4xx Client Error\",\n    toint(StatusCode) >= 500 and toint(StatusCode) < 600, \"5xx Server Error\",\n    \"Other\")\n| order by Transactions desc",
        "size": 0,
        "title": "HTTP Status Codes",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "http-status"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsMethod) and CsMethod != \"-\"\n| summarize Transactions = count() by Method = CsMethod\n| order by Transactions desc",
        "size": 0,
        "title": "HTTP Methods Distribution",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "http-methods"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where ScStatus >= 400\n| extend StatusCategory = iff(ScStatus >= 500, \"5xx Server Error\", \"4xx Client Error\")\n| summarize Errors = count() by bin(TimeGenerated, 1h), StatusCategory\n| order by TimeGenerated asc",
        "size": 0,
        "title": "HTTP Errors Over Time",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "customWidth": "100",
      "name": "http-errors-time"
    },
    {
      "type": 1,
      "content": {
        "json": "## Client Information"
      },
      "name": "client-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCOs) and XCOs != \"-\"\n| summarize Transactions = count() by OS = XCOs\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Operating Systems",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "os-distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCBrowser) and XCBrowser != \"-\"\n| summarize Transactions = count() by Browser = XCBrowser\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Browsers",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "browser-distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCDevice) and XCDevice != \"-\"\n| summarize Transactions = count() by Device = XCDevice\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "Device Types",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "device-distribution"
    },
    {
      "type": 1,
      "content": {
        "json": "## Security Insights"
      },
      "name": "security-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsTrafficType) and XCsTrafficType != \"-\"\n| summarize Transactions = count() by TrafficType = XCsTrafficType\n| order by Transactions desc",
        "size": 0,
        "title": "Traffic Types",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "traffic-types"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XPolicyAction) and XPolicyAction != \"-\"\n| summarize \n    Count = count(),\n    UniqueUsers = dcount(CsUsername)\n    by PolicyAction = XPolicyAction, PolicyName = XPolicyName\n| order by Count desc\n| take 20",
        "size": 0,
        "title": "Policy Actions",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "policy-actions"
    },
    {
      "type": 1,
      "content": {
        "json": "## Threat Protection"
      },
      "name": "threat-protection-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XTpMalwareName) and XTpMalwareName != \"-\"\n| summarize \n    Detections = count(),\n    AffectedUsers = dcount(CsUsername),\n    AffectedHosts = dcount(CsHost)\n    by Malware = XTpMalwareName, Severity = XTpSeverity, Engine = XTpEngine\n| order by Detections desc\n| take 20",
        "size": 0,
        "title": "Malware Detections",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Detections",
              "formatter": 4,
              "formatOptions": {
                "palette": "red"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "tp-malware"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XTpSeverity) and XTpSeverity != \"-\"\n| summarize Detections = count() by Severity = XTpSeverity\n| order by Detections desc",
        "size": 0,
        "title": "Threat Severity Distribution",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "tp-severity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XTpResult) and XTpResult != \"-\"\n| summarize Count = count() by Result = XTpResult, Engine = XTpEngine\n| order by Count desc\n| take 20",
        "size": 0,
        "title": "Threat Protection Results by Engine",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "orange"
              }
            }
          ]
        }
      },
      "customWidth": "100",
      "name": "tp-results"
    },
    {
      "type": 1,
      "content": {
        "json": "## Endpoint Posture"
      },
      "name": "endpoint-posture-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCDeviceClassification) and XCDeviceClassification != \"-\"\n| summarize Transactions = count() by DeviceClassification = XCDeviceClassification\n| order by Transactions desc",
        "size": 0,
        "title": "Device Classification",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "endpoint-classification"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCOsFamily) and XCOsFamily != \"-\"\n| summarize Transactions = count() by OSFamily = XCOsFamily\n| order by Transactions desc\n| take 10",
        "size": 0,
        "title": "OS Family",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "endpoint-osfamily"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCNsclientVersion) and XCNsclientVersion != \"-\"\n| summarize Devices = dcount(XCDeviceUid) by ClientVersion = XCNsclientVersion\n| order by Devices desc\n| take 10",
        "size": 0,
        "title": "Netskope Client Versions",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "34",
      "name": "endpoint-clientversion"
    },
    {
      "type": 1,
      "content": {
        "json": "## Process Activity"
      },
      "name": "process-activity-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsProcess) and XCsProcess != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueUsers = dcount(CsUsername),\n    UniqueHosts = dcount(CsHost)\n    by Process = XCsProcess\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top Processes",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-processes"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsParentProcess) and XCsParentProcess != \"-\"\n| summarize Transactions = count() by ParentProcess = XCsParentProcess\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top Parent Processes",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-parent-processes"
    },
    {
      "type": 1,
      "content": {
        "json": "## Identity & Authentication"
      },
      "name": "identity-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCAuthnUser) and XCAuthnUser != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueApps = dcount(XCsApp)\n    by AuthUser = XCAuthnUser, AuthSource = XCAuthnSource\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top Authenticated Users",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-auth-users"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCAuthzGroups) and XCAuthzGroups != \"-\"\n| summarize Transactions = count(), UniqueUsers = dcount(CsUsername) by Group = XCAuthzGroups\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Top Authorization Groups",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "purple"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "top-authz-groups"
    },
    {
      "type": 1,
      "content": {
        "json": "## Action Analysis"
      },
      "name": "action-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XAction) and XAction != \"-\"\n| summarize Transactions = count() by Action = XAction\n| order by Transactions desc",
        "size": 0,
        "title": "Actions Distribution",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "action-distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XActionReason) and XActionReason != \"-\"\n| summarize Count = count() by ActionReason = XActionReason, Action = XAction\n| order by Count desc\n| take 20",
        "size": 0,
        "title": "Action Reasons",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "yellow"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "action-reasons"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XRCountry) and XRCountry != \"-\"\n| summarize Transactions = count(), UniqueHosts = dcount(CsHost) by RemoteCountry = XRCountry\n| order by Transactions desc\n| take 20",
        "size": 0,
        "title": "Traffic by Remote Destination Country",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ]
        }
      },
      "customWidth": "100",
      "name": "remote-country"
    },
    {
      "type": 1,
      "content": {
        "json": "## Top Destinations"
      },
      "name": "destinations-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsHost) and CsHost != \"-\"\n| summarize \n    Transactions = count(),\n    UniqueUsers = dcount(CsUsername),\n    TotalBytes = sum(Bytes)\n    by Host = CsHost\n| order by Transactions desc\n| take 25",
        "size": 0,
        "title": "Top 25 Destination Hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Transactions",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "TotalBytes",
              "formatter": 4,
              "formatOptions": {
                "palette": "turquoise"
              }
            }
          ]
        }
      },
      "customWidth": "60",
      "name": "top-hosts"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsHost) and CsHost != \"-\"\n| summarize TotalBytes = sum(Bytes) by Host = CsHost\n| order by TotalBytes desc\n| take 10",
        "size": 0,
        "title": "Top Hosts by Data Volume",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "40",
      "name": "top-hosts-bytes"
    },
    {
      "type": 1,
      "content": {
        "json": "## Access Methods"
      },
      "name": "access-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XCsAccessMethod) and XCsAccessMethod != \"-\"\n| summarize Transactions = count() by AccessMethod = XCsAccessMethod\n| order by Transactions desc",
        "size": 0,
        "title": "Access Methods",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "access-methods"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(CsUriScheme) and CsUriScheme != \"-\"\n| summarize Transactions = count() by Scheme = CsUriScheme\n| order by Transactions desc",
        "size": 0,
        "title": "URI Schemes (HTTP vs HTTPS)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "uri-schemes"
    },
    {
      "type": 1,
      "content": {
        "json": "## Detailed Transaction Logs"
      },
      "name": "logs-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| project \n    TimeGenerated,\n    User = CsUsername,\n    SourceIP = CIp,\n    Method = CsMethod,\n    Host = CsHost,\n    URI = CsUri,\n    StatusCode = ScStatus,\n    Application = XCsApp,\n    Category = XCategory,\n    BytesIn = CsBytes,\n    BytesOut = ScBytes,\n    SourceCountry = XCCountry,\n    DestCountry = XSCountry,\n    PolicyAction = XPolicyAction\n| order by TimeGenerated desc\n| take 500",
        "size": 0,
        "title": "Recent Transactions (Last 500)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "filter": true
        }
      },
      "name": "transaction-logs"
    },
    {
      "type": 1,
      "content": {
        "json": "## SSL Errors & Bypass Events"
      },
      "name": "ssl-section-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XServerSslErr) and XServerSslErr != \"None\" and XServerSslErr != \"-\"\n| summarize \n    ErrorCount = count(),\n    AffectedUsers = dcount(CsUsername),\n    AffectedHosts = dcount(CsHost)\n    by SSLError = XServerSslErr\n| order by ErrorCount desc",
        "size": 0,
        "title": "Server SSL Errors",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ErrorCount",
              "formatter": 4,
              "formatOptions": {
                "palette": "red"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "ssl-server-errors"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(XClientSslErr) and XClientSslErr != \"None\" and XClientSslErr != \"-\"\n| summarize \n    ErrorCount = count(),\n    AffectedUsers = dcount(CsUsername)\n    by SSLError = XClientSslErr\n| order by ErrorCount desc",
        "size": 0,
        "title": "Client SSL Errors",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ErrorCount",
              "formatter": 4,
              "formatOptions": {
                "palette": "orange"
              }
            }
          ]
        }
      },
      "customWidth": "50",
      "name": "ssl-client-errors"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "NetskopeWebTransactions_CL\n| where TimeGenerated {TimeRange}\n| where XSslBypass == \"yes\"\n| summarize \n    BypassCount = count(),\n    UniqueUsers = dcount(CsUsername)\n    by BypassReason = XSslBypassReason, Host = CsHost\n| order by BypassCount desc\n| take 20",
        "size": 0,
        "title": "SSL Bypass Events",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "BypassCount",
              "formatter": 4,
              "formatOptions": {
                "palette": "yellow"
              }
            }
          ]
        }
      },
      "customWidth": "100",
      "name": "ssl-bypass"
    },
    {
      "type": 1,
      "content": {
        "json": "## Data Quality - Duplicate Analysis"
      },
      "name": "duplicate-section-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let filtered = NetskopeWebTransactions_CL | where TimeGenerated {TimeRange} | where isnotempty(XTransactionId);\nlet total_rows = filtered | summarize total = count() | project total;\nlet duplicate_rows = filtered | summarize c = count() by XTransactionId | where c > 1 | summarize duplicates = sum(c - 1) | project duplicates;\nprint duplicate_percentage = 100.0 * toscalar(duplicate_rows) / toscalar(total_rows)",
        "size": 4,
        "title": "Duplicate Transaction Percentage",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": true,
          "titleContent": {
            "columnMatch": "duplicate_percentage",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "customWidth": "50",
      "name": "duplicate-percentage"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let filtered = NetskopeWebTransactions_CL | where TimeGenerated {TimeRange} | where isnotempty(XTransactionId);\nlet total_rows = filtered | summarize total = count();\nlet unique_rows = filtered | summarize by XTransactionId | count;\nlet duplicate_rows = filtered | summarize c = count() by XTransactionId | where c > 1 | summarize duplicates = sum(c - 1);\nprint \n    TotalRecords = toscalar(total_rows),\n    UniqueTransactions = toscalar(unique_rows),\n    DuplicateRecords = toscalar(duplicate_rows),\n    DuplicatePercentage = round(100.0 * toscalar(duplicate_rows) / toscalar(total_rows), 2)",
        "size": 0,
        "title": "Duplicate Analysis Details",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "duplicate-details"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-NetskopeWebTxWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}