{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "adc91142-7242-43b1-845d-03706394c2fa",
            "version": "KqlParameterItem/1.0",
            "name": "TimeGenerated",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| extend DeviceType = iff(IsMobile, \"Mobile\", \"Desktop/Other\")\n| summarize EventCount = count() by DeviceType\n",
        "size": 4,
        "title": "Mobile Traffic Distribution",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "Mobile Traffic Distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize Count = count() by EventType\n",
        "size": 4,
        "title": "Event Types Distribution",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "Event Types Distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize Events = count() by SrcHostname\n| top 8 by Events desc\n",
        "size": 4,
        "title": "Device Hostname Distribution",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "Device Hostname Distribution"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| extend ScopeSensitivity = case(\n    Scope startswith \"delete\", \"High Privilege\",\n    Scope startswith \"update\", \"Medium Privilege\",\n    Scope startswith \"create\", \"Low Privilege\",\n    Scope startswith \"read\", \"Read-Only\",\n    \"Other\"\n)\n| summarize EventCount = count() by ScopeSensitivity\n",
        "size": 4,
        "title": "Scope Sensitivity Split",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "Scope Sensitivity Split"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| extend Domain = extract(@\"https?://([^/]+)\", 1, Audience)\n| summarize EventCount = count() by Domain\n| top 10 by EventCount\n",
        "size": 4,
        "title": "Access Target Domains",
        "timeContext": {
          "durationMs": 86400000
        },
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true
        }
      },
      "customWidth": "20",
      "name": "Access Target Domains"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize EventCount = count() by ClientName\n| top 10 by EventCount desc\n",
        "size": 0,
        "title": "Client Applications by Usage",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "ClientName",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "EventCount",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "ClientName",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "EventCount",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "Client Applications by Usage"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize EventsGenerated = count() by ActorUsername\n| top 10 by EventsGenerated desc\n",
        "size": 0,
        "title": "Most Active Users",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "ActorUsername",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "EventsGenerated",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false
        }
      },
      "name": "Most Active Users"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize Count = count() by SrcIpAddr\n| top 10 by Count desc\n",
        "size": 0,
        "title": "Frequent Source IP Addresses",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Frequent Source IP Addresses"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize EventCount = count() by Scope\n| top 10 by EventCount desc\n",
        "size": 0,
        "title": "Most Accessed API Scopes",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "name": "Most Accessed API Scopes"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize Count = count() by HttpUserAgent\n| order by Count desc\n| top 10 by Count\n",
        "size": 0,
        "title": "User Agent Trends",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "HttpUserAgent",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "HttpUserAgent",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "User Agent Trends"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| where EventType in (\"seccft\", \"logout\")\n| summarize SuspiciousEvents = count() by bin(TimeGenerated, 15m), EventType\n| order by TimeGenerated asc\n",
        "size": 0,
        "title": "Security Critical Events (seccft, logout)",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "name": "Security Critical Events (seccft, logout)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Auth0Logs_CL\n| summarize TotalEvents = count() by bin(TimeGenerated, 10m)\n| order by TimeGenerated asc\n",
        "size": 0,
        "title": "Events Over Time",
        "timeContextFromParameter": "TimeGenerated",
        "showRefreshButton": true,
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "Events Over Time"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-Auth0Workbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}