{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**Fortiweb**](https://aka.ms/sentinel-FortiwebDataConnector-parser) which is deployed with the Microsoft Sentinel Solution."
      },
      "name": "text - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "2088f290-65ee-4357-badb-55ce732a5004",
            "cellValue": "tab",
            "linkTarget": "parameter",
            "linkLabel": "Fortiweb Threats Overview",
            "subTarget": "Fortiweb_threat_overview",
            "style": "link"
          }
        ]
      },
      "name": "links - 1"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "c64d5d3d-90c6-484a-ab88-c70652b75b6e",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 3628800000,
              "endTime": "2022-12-13T17:55:00.000Z"
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| summarize count() by EventSubType",
        "size": 0,
        "title": "Attack Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "Attack Type"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where isnotempty(RequestClientApplication)\n| summarize count() by RequestClientApplication ",
        "size": 0,
        "title": "Client Application",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "Client Application"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where isnotempty(RequestMethod)\n| summarize count() by RequestMethod ",
        "size": 0,
        "title": "Request Methods",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "Request Methods"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where isnotempty(owaspTop10)\n| summarize count() by owaspTop10 ",
        "size": 0,
        "title": "Owasp Top 10 - Vulnerabilities",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "25",
      "name": "owaspTop10"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where EventType =~ \"attack\"\n| summarize count() by ThreatLevel",
        "size": 0,
        "title": "Threat Level",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Count",
          "sortOrderField": 2,
          "size": "auto"
        }
      },
      "customWidth": "25",
      "name": "Threat Level"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where EventType == \"attack\"\n| summarize count() by srcCountry",
        "size": 0,
        "title": "Threat Source- Countries",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Count",
          "sortOrderField": 2,
          "size": "auto"
        }
      },
      "customWidth": "25",
      "name": "Threat Source- Countries"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where EventType == \"attack\"\n| summarize count() by SrcIpAddr",
        "size": 0,
        "title": "Top Threat Client IPs",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Count",
          "sortOrderField": 2,
          "size": "auto"
        }
      },
      "customWidth": "25",
      "name": "Top Threat Client IPs"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where EventType =~ \"attack\"\n| summarize count() by DvcAction",
        "size": 0,
        "title": "Actions against Threats",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Count",
          "sortOrderField": 2,
          "size": "auto"
        }
      },
      "customWidth": "25",
      "name": "Actions against Threats"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Fortiweb\n| where EventType =~ \"attack\"\n| project TimeGenerated, ThreatType = EventSubType,ThreatSubType = subType , ThreatSeverity = EventSeverity,Action = DvcAction, SourceIPAddress = SrcIpAddr, SourceCountry = srcCountry, ClientApplication = RequestClientApplication\n| limit 200",
        "size": 0,
        "title": "Top 200 Threat Details",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "rowLimit": 200,
          "filter": true
        },
        "tileSettings": {
          "titleContent": {
            "columnMatch": "title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "showBorder": false,
          "sortCriteriaField": "Count",
          "sortOrderField": 2,
          "size": "auto"
        }
      },
      "customWidth": "100",
      "name": "Top 200 Threat Details"
    }
  ],
  "fromTemplateId": "sentinel-FortiwebWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}