{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "This workbook gives an insight into the health of all the Windows VMs in this subscription running Eaton Foreseer and the unauthorized access into the Eaton Foreseer application running on these VMs."
      },
      "name": "text - 1"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "80e332f7-8176-461f-b27a-0a52242fe6c9",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          },
          {
            "id": "5a93ede8-361d-4cc6-93f8-967dfc355143",
            "version": "KqlParameterItem/1.0",
            "name": "Activity",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SecurityEvent\r\n| summarize Count = count() by Activity\r\n| order by Count desc, Activity asc\r\n| project Value = Activity, Label = strcat(Activity, ' - ', Count)",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "All"
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "## Eaton Foreseer Application Information ##\r\n\r\nLogin information pertaining to the Eaton Foreseer application."
      },
      "name": "text - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityEvent\r\n| where ProcessName has \"Foreseer\"\r\n| distinct Computer, IpAddress\r\n| project\r\n    Computer,\r\n    IpAddress;",
        "size": 0,
        "title": "Computers running Eaton Foreseer",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "",
        "exportParameterName": "EatonComputers",
        "exportDefaultValue": "{\"TenantId\":\"\",\"Computer\":\"*\"}",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "18",
      "name": "query - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where EventID == 4624 and AccountType == 'User'\r\n// Looking for Eaton Foreseer Events\r\n| where ProcessName has \"Foreseer\"\r\n| extend Name = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account));\r\nlet appData = data\r\n| summarize TotalCount = count() by Name, Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name\r\n    | project-away TimeGenerated) on Name\r\n| order by TotalCount desc, Name asc\r\n| project Name, TotalCount, Trend, Computer\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Name, Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name, Activity\r\n    | project-away TimeGenerated) on Name, Activity\r\n| order by TotalCount desc, Name asc\r\n| project Name, Activity, TotalCount, Trend, Computer\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Name\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1, Computer\r\n| union (appData \r\n    | project Id, Name = Name, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
        "size": 0,
        "title": "Eaton Foreseer Application User login success",
        "timeContextFromParameter": "TimeRange",
        "exportParameterName": "Userinfo",
        "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Id",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "blueGreen",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "greenDark",
                "showIcon": true
              }
            },
            {
              "columnMatch": "IpAddress",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "ParentId",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "idColumn": "Id",
            "parentColumn": "ParentId",
            "treeType": 0,
            "expanderColumn": "Name"
          }
        }
      },
      "customWidth": "41",
      "name": "query - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where EventID == 4625 and AccountType == 'User'\r\n// Look for Eaton Foreseer events\r\n| where ProcessName has \"Foreseer\"\r\n| extend Name = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account));\r\nlet appData = data\r\n| summarize TotalCount = count() by Name, Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name\r\n    | project-away TimeGenerated) on Name\r\n| order by TotalCount desc, Name asc\r\n| project Name, TotalCount, Trend, Computer\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Name, Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name, Activity\r\n    | project-away TimeGenerated) on Name, Activity\r\n| order by TotalCount desc, Name asc\r\n| project Name, Activity, TotalCount, Trend, Computer\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Name\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1, Computer\r\n| union (appData \r\n    | project Id, Name = Name, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
        "size": 0,
        "title": "Eaton Foreseer Application User login failure",
        "timeContextFromParameter": "TimeRange",
        "exportParameterName": "Userinfo",
        "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Id",
              "formatter": 5
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "yellowOrangeRed"
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "redDark"
              }
            },
            {
              "columnMatch": "ParentId",
              "formatter": 5
            },
            {
              "columnMatch": "IpAddress",
              "formatter": 5
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "idColumn": "Id",
            "parentColumn": "ParentId",
            "treeType": 0,
            "expanderColumn": "Name"
          }
        }
      },
      "customWidth": "40",
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityEvent\r\n// Look for all events relating to user logins  \r\n| where EventID in (4624,4625,4648,4675,4634,4647)  \r\n| where AccountType == \"User\" \r\n// Filter for data present  \r\n| where isnotempty(ProcessName)  \r\n| where isnotempty(TargetUserName)  \r\n// Look for all events that relate to the Eaton Foreseer application  \r\n| where ProcessName has \"Foreseer\"  \r\n// Ignore known user accounts (please edit based on your allowed users)  \r\n| where TargetUserName !in (\"eaton_superuser\", \"janedoe\", \"johndoe\")  \r\n| summarize TimeGenerated=arg_min(TimeGenerated, *) by TargetUserName, Computer \r\n| extend LoginStatus=iff(EventID==4624, 'Success', 'Failure')\r\n| project      \r\n    TimeGenerated,\r\n    WindowsEventID = EventID,\r\n    IPCustomEntity = IpAddress,\r\n    HostCustomEntity = Computer,\r\n    UserEntity = TargetUserName,\r\n    LoginStatus,\r\n    Process,\r\n    ProcessName\r\n\r\n\r\n",
        "size": 0,
        "title": "Eaton Foreseer Application Anomalous Logins",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 7"
    },
    {
      "type": 1,
      "content": {
        "json": "# Additional Information #\r\n\r\nInformation on security related activity and processes in all the machines that are running Eaton application."
      },
      "name": "text - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| join kind=leftsemi (Computers) on Computer\r\n;\r\ndata\r\n| summarize Count = count() by Activity\r\n| join kind = fullouter (datatable(Activity:string)['Medium', 'high', 'low']) on Activity\r\n| project Activity = iff(Activity == '', Activity1, Activity), Count = iff(Activity == '', 0, Count)\r\n| join kind = inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by Activity)\r\n on Activity\r\n| project-away Activity1, TimeGenerated\r\n| extend Activitys = Activity\r\n| union (\r\n data \r\n | summarize Count = count() \r\n | extend jkey = 1\r\n | join kind=inner (data\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\r\n | extend jkey = 1) on jkey\r\n | extend Activity = 'All', Activitys = '*' \r\n)\r\n| order by Count desc\r\n| take 10",
        "size": 4,
        "title": "Top 10 activities - click to filter by activity",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "Activity",
        "exportParameterName": "ActivityPiker",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Activity",
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto",
              "showIcon": true
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Trend",
            "formatter": 9,
            "formatOptions": {
              "palette": "lightBlue",
              "showIcon": true
            }
          },
          "showBorder": false
        }
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\" and AccountType == 'User'\r\n| join kind=leftsemi (Computers) on Computer\r\n| extend Name = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account));\r\nlet appData = data\r\n| summarize TotalCount = count() by Name\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name\r\n    | project-away TimeGenerated) on Name\r\n| order by TotalCount desc, Name asc\r\n| project Name, TotalCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Name\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Name, Activity\r\n    | project-away TimeGenerated) on Name, Activity\r\n| order by TotalCount desc, Name asc\r\n| project Name, Activity, TotalCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Name\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1\r\n| union (appData \r\n    | project Id, Name = Name, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
        "size": 0,
        "title": "All Security related User activities",
        "timeContextFromParameter": "TimeRange",
        "exportParameterName": "Userinfo",
        "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Id",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "blueGreen",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "greenDark",
                "showIcon": true
              }
            },
            {
              "columnMatch": "IpAddress",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "ParentId",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "idColumn": "Id",
            "parentColumn": "ParentId",
            "treeType": 0,
            "expanderColumn": "Name"
          }
        }
      },
      "customWidth": "50",
      "name": "query - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet data = SecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\" and AccountType == 'Machine'\r\n| join kind=leftsemi (Computers) on Computer\r\n| extend user = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account))\r\n| where dynamic({Userinfo}).Type == '*' or (dynamic({Userinfo}).Type == 'Computer' and user == dynamic({Userinfo}).Name);\r\nlet appData = data\r\n| summarize TotalCount = count() by Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer\r\n    | project-away TimeGenerated) on Computer\r\n| order by TotalCount desc, Computer asc\r\n| project Computer, TotalCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , Computer\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by Computer, Activity\r\n    | project-away TimeGenerated) on Computer, Activity\r\n| order by TotalCount desc, Computer asc\r\n| project Computer, Activity, TotalCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on Computer\r\n| project Id, Name = Activity, Type = 'Activity', ['Activity Count'] = TotalCount, Trend, ParentId = Id1\r\n| union (appData \r\n    | project Id, Name = Computer, Type = 'Computer', ['Activity Count'] = TotalCount, Trend )\r\n| order by ['Activity Count'] desc, Name asc",
        "size": 0,
        "title": "All Security related Machine activities",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "",
        "exportParameterName": "MachineInfo",
        "exportDefaultValue": "{ \"Name\":\"\", \"Type\":\"*\"}",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Id",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Activity Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "blue",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "ParentId",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "idColumn": "Id",
            "parentColumn": "ParentId",
            "treeType": 0,
            "expanderColumn": "Name"
          }
        }
      },
      "customWidth": "50",
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet Users = dynamic({Userinfo});\r\nlet Machines = dynamic({MachineInfo});\r\nSecurityEvent\r\n| where LogonTypeName != \"\"\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\"\r\n| join kind=leftsemi (Computers) on Computer\r\n| extend user = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account))\r\n| where (Users.Type == '*' or (Users.Type == 'Computer' and user == Users.Name)) and (Machines.Type == '*' or (Machines.Type == 'Computer' and Computer == Machines.Name))\r\n| summarize Count = count() by LogonTypeName = strcat( \"Logon type: \", LogonTypeName), Activity, user\r\n| order by Count",
        "size": 0,
        "title": "Logon activity types",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "green",
                "showIcon": true,
                "aggregation": "Sum"
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "LogonTypeName",
              "Activity"
            ],
            "expandTopLevel": false
          }
        }
      },
      "name": "query - 11"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet Users = dynamic({Userinfo});\r\nlet Machines = dynamic({MachineInfo});\r\nSecurityEvent\r\n| where Process != \"\" and Process != \"-\"\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\"\r\n| join kind=leftsemi (Computers) on Computer\r\n| extend Name = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account))\r\n| where (Users.Type == '*' or (Users.Type == 'Computer' and Name == Users.Name)) and (Machines.Type == '*' or (Machines.Type == 'Computer' and Computer == Machines.Name))\r\n| summarize Count = count() by Process, bin(TimeGenerated, 1h)",
        "size": 0,
        "title": "All Processes",
        "color": "lightBlue",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart"
      },
      "customWidth": "30",
      "name": "query - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Computers = (\r\nSecurityEvent\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where AccountType == 'User'\r\n| where ProcessName has \"Foreseer\"\r\n| summarize by Computer\r\n);\r\nlet Users = dynamic({Userinfo});\r\nlet Machines = dynamic({MachineInfo});\r\nSecurityEvent\r\n| where Process != \"\" and Process != \"-\"\r\n| where \"{Activity:lable}\" == \"All\" or Activity in ({Activity})\r\n| where Activity == '{ActivityPiker}' or '{ActivityPiker}' == \"All\"\r\n| join kind=leftsemi (Computers) on Computer\r\n| extend user = extract(@'^(.*\\\\)?([^@]*)(@.*)?$', 2, tolower(Account))\r\n| where (Users.Type == '*' or (Users.Type == 'Computer' and user == Users.Name)) and (Machines.Type == '*' or (Machines.Type == 'Computer' and Computer == Machines.Name))\r\n| summarize Count = count() by Process, Activity, user, Computer, bin(TimeGenerated, 1h)\r\n| order by TimeGenerated, Count",
        "size": 0,
        "title": "All Processes details",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true
        }
      },
      "customWidth": "70",
      "name": "query - 10"
    }
  ],
  "fromTemplateId": "sentinel-EatonForeseerHealthAndAccess",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}