{
  "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "# Common Event Format Logs Overview\n---\n\nThis Workbook gives an overview of ingestion of logs in the CommonSecurityLog table"
        },
        "name": "text - 2"
      },
      {
        "type": 1,
        "content": {
          "json": "## Log Ingestion Overview (Kb)\r\n---"
        },
        "name": "text - 3"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "CommonSecurityLog\n| where TimeGenerated >= ago(30d)\n| summarize TotalVolumeIngested = round(sum(_BilledSize)/(1024)) by DeviceProduct",
          "size": 1,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "tiles",
          "tileSettings": {
            "titleContent": {
              "columnMatch": "TotalVolumeIngested"
            },
            "subtitleContent": {
              "columnMatch": "DeviceProduct"
            },
            "showBorder": true
          }
        },
        "name": "query - 2"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "items": [
            {
              "type": 9,
              "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                  {
                    "id": "37fd3af4-5d65-41e2-81ae-0720f281eb04",
                    "version": "KqlParameterItem/1.0",
                    "name": "Subscription",
                    "type": 6,
                    "isRequired": true,
                    "multiSelect": true,
                    "quote": "'",
                    "delimiter": ",",
                    "typeSettings": {
                      "additionalResourceOptions": [
                        "value::all"
                      ],
                      "includeAll": true
                    },
                    "timeContext": {
                      "durationMs": 86400000
                    },
                    "value": [
                      "/subscriptions/5733bcb3-7fde-4caf-8629-41dc15e3b352",
                      "/subscriptions/ebb79bc0-aa86-44a7-8111-cabbe0c43993"
                    ]
                  },
                  {
                    "id": "0407e413-4562-4a87-b660-72facb921954",
                    "version": "KqlParameterItem/1.0",
                    "name": "TimeRange",
                    "type": 4,
                    "isRequired": true,
                    "typeSettings": {
                      "selectableValues": [
                        {
                          "durationMs": 300000
                        },
                        {
                          "durationMs": 900000
                        },
                        {
                          "durationMs": 1800000
                        },
                        {
                          "durationMs": 3600000
                        },
                        {
                          "durationMs": 14400000
                        },
                        {
                          "durationMs": 43200000
                        },
                        {
                          "durationMs": 86400000
                        },
                        {
                          "durationMs": 172800000
                        },
                        {
                          "durationMs": 259200000
                        },
                        {
                          "durationMs": 604800000
                        },
                        {
                          "durationMs": 1209600000
                        },
                        {
                          "durationMs": 2419200000
                        },
                        {
                          "durationMs": 2592000000
                        },
                        {
                          "durationMs": 5184000000
                        },
                        {
                          "durationMs": 7776000000
                        }
                      ]
                    },
                    "timeContext": {
                      "durationMs": 86400000
                    },
                    "value": {
                      "durationMs": 1800000
                    }
                  },
                  {
                    "id": "f5f6d366-40c3-4b51-a62f-06665d374327",
                    "version": "KqlParameterItem/1.0",
                    "name": "ConnectedStatus",
                    "type": 2,
                    "isRequired": true,
                    "multiSelect": true,
                    "quote": "'",
                    "delimiter": ",",
                    "query": "CommonSecurityLog  \r\n| summarize EventCount_TimeRange =  countif(TimeGenerated {TimeRange}), EventCount_Last30Days = countif(TimeGenerated > ago(30d)) by  DeviceProduct\r\n| project ConnectedStatus = iff(EventCount_Last30Days > 0, \"Connected\", \"Not-Connected\")\r\n| distinct ConnectedStatus\r\n| order by ConnectedStatus asc",
                    "typeSettings": {
                      "additionalResourceOptions": [],
                      "showDefault": false
                    },
                    "timeContext": {
                      "durationMs": 2592000000
                    },
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "value": [
                      "Connected"
                    ]
                  }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
              },
              "name": "parameters - 0"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "let All_DeviceProduct_Table = CommonSecurityLog | summarize by DeviceProduct;\r\nlet OOTBSources = externaldata(ProductName: string)\r\n[@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEFConnectors.csv\"]\r\nwith (format=\"csv\", ignoreFirstRecord=true);\r\nAll_DeviceProduct_Table | join kind=fullouter \r\n(CommonSecurityLog  \r\n| summarize EventCount_TimeRange =  countif(TimeGenerated {TimeRange}), EventCount_Last30Days = countif(TimeGenerated > ago(30d)) by  DeviceProduct\r\n| extend ConnectionStatus = iff(EventCount_Last30Days > 0, \"Connected\", \"Not-Connected\")\r\n| extend OutofBoxSupport = iif(DeviceProduct in (OOTBSources), \"Available\", \"Unavailable\")\r\n)\r\non DeviceProduct\r\n| where ConnectionStatus in ({ConnectedStatus}) \r\n| extend DeviceProduct = coalesce(DeviceProduct, DeviceProduct1)\r\n| extend EventCount_TimeRange = coalesce(EventCount_TimeRange, 0)\r\n| extend EventCount_Last30Days = coalesce(EventCount_Last30Days, 0)\r\n| extend ConnectionStatus = coalesce(ConnectionStatus, \"Not-Connected\")\r\n| project-away DeviceProduct1, EventCount_TimeRange\r\n//| project DeviceProduct, EventCount_Last30Days, OutofBoxSupport",
                "size": 0,
                "timeContext": {
                  "durationMs": 2592000000
                },
                "exportFieldName": "DeviceProduct",
                "exportParameterName": "DeviceProduct",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "gridSettings": {
                  "formatters": [
                    {
                      "columnMatch": "ConnectionStatus",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "operator": "==",
                            "thresholdValue": "Connected",
                            "representation": "success",
                            "text": "{0}{1}"
                          },
                          {
                            "operator": "!=",
                            "thresholdValue": "Connected",
                            "representation": "error",
                            "text": "{0}{1}"
                          },
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "success",
                            "text": "{0}{1}"
                          }
                        ]
                      },
                      "numberFormat": {
                        "unit": 0,
                        "options": {
                          "style": "decimal"
                        }
                      }
                    },
                    {
                      "columnMatch": "OutofBox",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "operator": "==",
                            "thresholdValue": "Available",
                            "representation": "Available",
                            "text": "{0}{1}"
                          },
                          {
                            "operator": "!=",
                            "thresholdValue": "Yes",
                            "representation": "Unavailable",
                            "text": "{0}{1}"
                          },
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "success",
                            "text": "{0}{1}"
                          }
                        ]
                      }
                    }
                  ],
                  "labelSettings": [
                    {
                      "columnId": "DeviceProduct",
                      "label": "Device Product"
                    }
                  ]
                }
              },
              "customWidth": "50",
              "name": "query - 1 - Copy"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": " let Now = now();\r\n(range TimeGenerated from ago(7d) to Now - 1d step 1d\r\n| extend Count = 0\r\n| union isfuzzy=true\r\n    (CommonSecurityLog\r\n    | where DeviceProduct == \"{DeviceProduct}\"\r\n    //| where DeviceProduct has \"PAN-OS\"\r\n    | summarize Count = count() by bin_at(TimeGenerated, 1d, Now))\r\n| summarize Count=max(Count) by bin_at(TimeGenerated, 1d, Now)\r\n| sort by TimeGenerated\r\n| project\r\n    Value = iff(isnull(Count), 0, Count),\r\n    Time = TimeGenerated,\r\n    Legend = \"{DeviceProduct}\")\r\n| render timechart ",
                "size": 0,
                "timeContext": {
                  "durationMs": 604800000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "timechart",
                "chartSettings": {
                  "showMetrics": false
                }
              },
              "customWidth": "50",
              "name": "query - 2"
            }
          ]
        },
        "name": "IngestedLogs"
      }
    ],
        "fromTemplateId": "CEFOverview",
          "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}