{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Palo Alto Prisma Cloud Overview\n---\n**NOTE**: This workbook depends on a parser based on a Kusto Function to work as expected [**PaloAltoPrismaCloud**](https://aka.ms/sentinel-PaloAltoPrismaCloud-parser) which is deployed with the Microsoft sentinel Solution."
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "600df9d4-1fb8-4255-a77e-27f5d12a5097",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PaloAltoPrismaCloud\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
        "size": 0,
        "title": "Events over time",
        "color": "grayBlue",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "tileSettings": {
          "showBorder": false
        }
      },
      "customWidth": "50",
      "name": "query - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| where isnotempty(ResourceRegion)\r\n| summarize count() by ResourceRegion",
              "size": 3,
              "title": "Events by Region",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| where isnotempty(ResourceCloudType)\r\n| summarize count() by ResourceCloudType",
              "size": 3,
              "title": "Events by Cloud type",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "query - 1"
          }
        ]
      },
      "customWidth": "50",
      "name": "group - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| summarize Low = countif(AlertSeverity =~ \"low\"), Medium = countif(AlertSeverity == \"medium\"), High = countif(AlertSeverity == \"high\") by bin_at(TimeGenerated, 1h, now())",
              "size": 0,
              "title": "Alerts over time",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "scatterchart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "color": "yellow"
                  },
                  {
                    "seriesName": "Medium",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "55",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| where Status =~ 'open'\r\n| project AlertId, AlertSeverity, AlertMessage",
              "size": 0,
              "title": "Open Alerts",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "40",
            "name": "query - 2",
            "styleSettings": {
              "margin": "20px"
            }
          }
        ]
      },
      "name": "group - 4"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| where isnotempty(SrcIpAddr)\r\n| summarize count() by SrcIpAddr\r\n| top 10 by count_ desc",
              "size": 3,
              "title": "Top Sources",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "30",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let u1 = PaloAltoPrismaCloud\r\n| where isnotempty(PolicyLastModifiedBy)\r\n| project User = PolicyLastModifiedBy;\r\nlet u2 = PaloAltoPrismaCloud\r\n| where isnotempty(UserName)\r\n| project User = UserName;\r\nlet users = union u1, u2;\r\nusers\r\n| summarize Actions = count() by User\r\n| top 10 by Actions desc\r\n\r\n",
              "size": 3,
              "title": "Top Users",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Actions",
                    "formatter": 4,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ]
              }
            },
            "customWidth": "30",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "PaloAltoPrismaCloud\r\n| where ResourceType =~ 'Login'\r\n| extend TimeFromNow = now() - TimeGenerated\r\n| extend TimeAgo = strcat(case(TimeFromNow < 2m, strcat(toint(TimeFromNow / 1m), ' seconds'), TimeFromNow < 2h, strcat(toint(TimeFromNow / 1m), ' minutes'), TimeFromNow < 2d, strcat(toint(TimeFromNow / 1h), ' hours'), strcat(toint(TimeFromNow / 1d), ' days')), ' ago')\r\n| project User= UserName, ['Source IP'] = SrcIpAddr, ['Login Result'] = strcat(iff(EventResult == 'Success', '✔️', '❌'), ' ', EventResult), ['Login Time'] = TimeAgo",
              "size": 0,
              "title": "User Logins",
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "35",
            "name": "query - 2"
          }
        ]
      },
      "name": "group - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PaloAltoPrismaCloud\r\n| where isnotempty(AlertMessage)\r\n| top 10 by TimeGenerated desc\r\n| extend NumSeverity = case(AlertSeverity =~ 'low', 1, AlertSeverity =~ 'medium', 2, 3)\r\n| project ['Alert Time'] = TimeGenerated, ['Alert Message'] = AlertMessage, ['Severity'] = NumSeverity, ResourceRegionId, ResourceId",
        "size": 0,
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Severity",
              "formatter": 8,
              "formatOptions": {
                "min": 1,
                "max": 3,
                "palette": "orangeRed"
              },
              "numberFormat": {
                "unit": 0,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        }
      },
      "name": "query - 6"
    }
  ],
  "fromTemplateId": "sentinel-PaloAltoPrismaCloudWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}