{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "f7f8867d-6fcd-41c3-a908-12de727e6f35",
            "version": "KqlParameterItem/1.0",
            "name": "date",
            "label": "Date",
            "type": 4,
            "isGlobal": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "e5d5d76d-a748-4f16-94f0-ffed5fecfa00",
            "version": "KqlParameterItem/1.0",
            "name": "threat_type",
            "label": "Threat Type",
            "type": 2,
            "isGlobal": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CyberSixgill_Alerts\r\n| where TimeGenerated > ago(720d)\r\n| project MyJson = parse_json(Threats)\r\n| mvexpand MyJson\r\n| summarize by MyJson = tostring(MyJson)\r\n| sort by MyJson asc",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "361f855c-e983-44c9-86b4-4f57286d77e1",
            "version": "KqlParameterItem/1.0",
            "name": "threat_level",
            "label": "Threat Level",
            "type": 2,
            "isGlobal": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "jsonData": "[{\"label\": \"Emerging\", \"value\": \"emerging\"},\r\n{\"label\": \"Imminent\", \"value\": \"imminent\"}]",
            "defaultValue": "value::all"
          },
          {
            "id": "a89b3f31-ac61-419b-94a0-553ccd3ac7ac",
            "version": "KqlParameterItem/1.0",
            "name": "status",
            "label": "Status",
            "type": 2,
            "isGlobal": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "jsonData": "[{\"label\": \"Treatment Required\", \"value\": \"treatment_required\"},\r\n{\"label\": \"In Treatment\", \"value\": \"in_treatment\"},\r\n{\"label\": \"Resolved\", \"value\": \"resolved\"}]",
            "defaultValue": "value::all"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CyberSixgill_Alerts\n| extend threats = parse_json(Threats)\n| where threats has_any ({threat_type})\n| where ThreatLevel has_any ({threat_level})\n| where StatusName has_any ({status})\n| project [\"Alert ID\"]=Id,Title=AlertTitle,[\"Threat Type\"]=strcat_array(threats, \",\"), Status=StatusName, [\"Threat Actor\"]=ThreatActor, [\"Threat Source\"]=ThreatSource, [\"Matched Assets\"]=Assets, [\"Portal URL\"]=PortalUrl, Content=Content\n//| where TimeGenerated {date}",
        "size": 2,
        "timeContextFromParameter": "date",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Portal URL",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url",
                "linkLabel": "View in Cybersixgill portal"
              }
            },
            {
              "columnMatch": "Content",
              "formatter": 0,
              "tooltipFormat": {
                "tooltip": "{0}"
              }
            }
          ],
          "rowLimit": 50,
          "filter": true
        }
      },
      "name": "cybersixgill-alerts-list"
    }
  ],
  "fallbackResourceIds": [
    ""
  ],
  "fromTemplateId": "sentinel-ActionableAlertsList",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}