{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# SOCRadar Integration Dashboard\n\nMonitor alarm imports, sync status, and analyze trends."
      },
      "name": "header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadar_Alarms_CL | summarize Count=count() by Severity | render piechart",
        "size": 1,
        "title": "Alarms by Severity",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "severity-chart",
      "customWidth": "50"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadar_Alarms_CL | summarize Count=count() by Status | render piechart",
        "size": 1,
        "title": "Alarms by Status",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "status-chart",
      "customWidth": "50"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadar_Alarms_CL | summarize Count=count() by bin(TimeGenerated, 1h) | render timechart",
        "size": 1,
        "title": "Alarms Over Time (Hourly)",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "timeline"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadar_Alarms_CL | summarize Count=count() by AlarmMainType | top 10 by Count | render barchart",
        "size": 1,
        "title": "Top 10 Alarm Types",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "types-chart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadar_Alarms_CL | project TimeGenerated, AlarmId, Severity, AlarmMainType, AlarmSubType, Title, Status | order by TimeGenerated desc | take 50",
        "size": 1,
        "title": "Recent Alarms (Last 50)",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "recent-alarms"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n### Audit Logs\nIf audit logging is enabled, you can monitor operations below."
      },
      "name": "audit-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadarAuditLog_CL | summarize Count=count() by EventType | render piechart",
        "size": 1,
        "title": "Audit Events by Type",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "audit-chart",
      "customWidth": "50"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SOCRadarAuditLog_CL | project TimeGenerated, EventType, AlarmId, Message | order by TimeGenerated desc | take 20",
        "size": 1,
        "title": "Recent Audit Events",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "audit-table",
      "customWidth": "50"
    }
  ],
  "fromTemplateId": "sentinel-SOCRadarWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
  "isLocked": false
}