{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## vArmour Application Controller\n---"
      },
      "name": "text - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let starttime = 30d;\nlet endtime = 0d;\nlet timeframe = 1h;\nlet TotalEventsThreshold = 5;\nlet ExeList = dynamic([\"POLICY_VIOLATION\"]);\nlet TimeSeriesData= \nCommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| where TimeGenerated between (startofday(ago(starttime))..startofday(ago(endtime)))\n| where Activity in (ExeList)\n| make-series Total=count() on TimeGenerated from ago(starttime) to ago(endtime) step timeframe by Activity;\nTimeSeriesData\n| render timechart \n",
              "size": 0,
              "title": "Violations against Policy (Incoming Rate)",
              "timeContext": {
                "durationMs": 259200000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 5",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| summarize count() by DestinationIP | top 10 by count_ desc \n|render piechart\n\n",
              "size": 0,
              "title": "Top 10 Destinations observed Counter to Policy (Potential Apps/Workloads under threat)",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 3",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| extend AppNameSrcDstPair = extract_all(\"AppName=;(\\\\w+)\", AdditionalExtensions)\n| summarize count() by tostring(AppNameSrcDstPair)\n| top 10 by count_\n",
              "size": 0,
              "title": "Top 10 Applications with Violations (AppName to AppName)",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 4",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 0"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| summarize count() by ApplicationProtocol | top 10 by count_ desc \n| render barchart\n",
              "size": 0,
              "title": "Top 10 Application Protocols involved in Violations (Potential Protocol Exposure)",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 4",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "title": "Top 10 Sources of Violations (Potential Compromised Workloads or User Risk)",
              "items": [
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| summarize count() by SourceIP | top 10 by count_ desc \n",
                    "size": 0,
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "sortBy": []
                  },
                  "customWidth": "50",
                  "name": "query - 2"
                }
              ]
            },
            "customWidth": "33",
            "name": "group - 4",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CommonSecurityLog\n| where DeviceVendor == \"vArmour\"\n| where DeviceProduct == \"AC\"\n| where Activity == \"POLICY_VIOLATION\"\n| extend PolicyName = extract(\"(\\\\w+{.*})\", 1, DeviceCustomString1)\n| summarize count() by PolicyName | top 10 by count_ desc \n",
              "size": 0,
              "title": "Policies with Violations (Risk Identification)",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "33",
            "name": "query - 4",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union withsource=_TableName *\n| summarize Count=count() by _TableName\n| render barchart",
              "size": 1,
              "title": "Types and Number of Events ingested",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "query - 2",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "group - 3"
    }
  ]
}