{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Security Alerts"
      },
      "name": "text - 10"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8ec26142-86ac-48f5-9fad-c98309958047",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                }
              ]
            },
            "timeContextFromParameter": "TimeRange"
          },
          {
            "id": "4cd4cbd6-3f2d-4350-9c36-b9292af7864e",
            "version": "KqlParameterItem/1.0",
            "name": "Hub",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\" \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId) \r\n| summarize Count = count() by hubId \r\n| project Value = hubId, Label = hubId",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\"  \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId)  \r\n| where hubId in ({Hub}) or \"All\" in ({Hub}) \r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by  AlertSeverity",
        "size": 0,
        "title": "Alerts trend",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "Medium",
              "color": "yellow"
            },
            {
              "seriesName": "High",
              "color": "red"
            },
            {
              "seriesName": "Low",
              "color": "blue"
            }
          ]
        }
      },
      "customWidth": "37",
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\"  \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId) \r\n| where hubId in ({Hub}) or \"All\" in ({Hub}) \r\n| summarize count() by AlertName\r\n| top 10 by count_",
        "size": 0,
        "title": "Top 10 alert types",
        "timeContext": {
          "durationMs": 604800000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "chartSettings": {
          "showMetrics": false
        }
      },
      "customWidth": "37",
      "name": "query - 4",
      "styleSettings": {
        "padding": "0"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\"  \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId) \r\n| where hubId in ({Hub}) or \"All\" in ({Hub}) \r\n| summarize count() by AlertSeverity",
        "size": 0,
        "title": "Alerts severity distribution",
        "timeContext": {
          "durationMs": 604800000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "High",
              "color": "red"
            },
            {
              "seriesName": "Medium",
              "color": "yellow"
            },
            {
              "seriesName": "Low",
              "color": "blue"
            }
          ]
        }
      },
      "customWidth": "26",
      "name": "query - 1",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\" \r\n| extend HubName = extract(\"[^/]*$\", 0, ResourceId) \r\n| where HubName in ({Hub}) or \"All\" in ({Hub}) \r\n| summarize Total = count(), High = countif(AlertSeverity == \"High\"), Medium = countif(AlertSeverity == \"Medium\"), Low = countif(AlertSeverity == \"Low\") by HubName\r\n| order by Total desc\r\n| top 10 by Total\r\n| project HubName, Total, High, Medium, Low",
        "size": 0,
        "title": "Hubs by alert count",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "High",
              "formatter": 8,
              "formatOptions": {
                "palette": "red",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Medium",
              "formatter": 8,
              "formatOptions": {
                "palette": "yellow",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Low",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Device",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "AlertName",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            }
          ],
          "labelSettings": [
            {
              "columnId": "Total"
            },
            {
              "columnId": "High"
            },
            {
              "columnId": "Medium"
            },
            {
              "columnId": "Low"
            }
          ]
        },
        "sortBy": []
      },
      "customWidth": "33",
      "name": "query - 13"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\" \r\n| extend Hub = extract(\"[^/]*$\", 0, ResourceId) \r\n| where Hub in ({Hub}) or \"All\" in ({Hub})\r\n| extend Device = strcat(tostring(parse_json(ExtendedProperties)[\"DeviceId\"]), \" (\", Hub, \")\")\r\n| summarize Total = count(), High = countif(AlertSeverity == \"High\"), Medium = countif(AlertSeverity == \"Medium\"), Low = countif(AlertSeverity == \"Low\") by Hub, AlertName, Device\r\n| order by Total desc\r\n| top 20 by Total\r\n| project Device, AlertName, Hub, Total, High, Medium, Low",
        "size": 0,
        "title": "Devices by alert count",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Device",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Hub",
              "formatter": 5,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Total",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true,
                "aggregation": "Sum"
              }
            },
            {
              "columnMatch": "High",
              "formatter": 5,
              "formatOptions": {
                "palette": "red",
                "showIcon": true,
                "aggregation": "Sum"
              }
            },
            {
              "columnMatch": "Medium",
              "formatter": 5,
              "formatOptions": {
                "palette": "orange",
                "showIcon": true,
                "aggregation": "Sum"
              }
            },
            {
              "columnMatch": "Low",
              "formatter": 5,
              "formatOptions": {
                "palette": "blue",
                "showIcon": true,
                "aggregation": "Sum"
              }
            }
          ],
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "Device"
            ]
          },
          "sortBy": [
            {
              "itemKey": "Total",
              "sortOrder": 2
            }
          ],
          "labelSettings": [
            {
              "columnId": "Device"
            },
            {
              "columnId": "AlertName",
              "label": "Alert"
            },
            {
              "columnId": "Hub"
            },
            {
              "columnId": "Total"
            },
            {
              "columnId": "High"
            },
            {
              "columnId": "Medium"
            },
            {
              "columnId": "Low"
            }
          ]
        },
        "sortBy": [
          {
            "itemKey": "Total",
            "sortOrder": 2
          }
        ]
      },
      "customWidth": "33",
      "name": "query - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let previousResults = SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\"  \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId) \r\n| where hubId in ({Hub}) or \"All\" in ({Hub}) \r\n| where TimeGenerated < {TimeRange:start} and TimeGenerated > {TimeRange:start} - ({TimeRange:end} - {TimeRange:start})  \r\n| summarize P=count() by AlertName;\r\nlet currentResults =  SecurityAlert \r\n| where ProductName == \"Azure Security Center for IoT\"  \r\n| extend  hubId = extract(\"[^/]*$\", 0, ResourceId) \r\n| where hubId in ({Hub}) or \"All\" in ({Hub}) \r\n| where TimeGenerated < {TimeRange:end} and TimeGenerated > {TimeRange:start} \r\n| summarize C=count() by AlertName;\r\ncurrentResults | join kind=fullouter (\r\n    previousResults\r\n) on AlertName \r\n| extend Previous = iff(isnull(P),0,P)  \r\n| extend Current = iff(isnull(C),0,C) \r\n| extend Change = ((Current - Previous)/todouble(Previous))*100 \r\n| extend Alert=iff(AlertName == \"\",AlertName1,AlertName)\r\n| project-away AlertName1, AlertName, C, P \r\n| project Alert, Previous, Current, Change\r\n| order by Change",
        "size": 0,
        "title": "Alerts status",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Previous",
              "formatter": 1,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Current",
              "formatter": 1,
              "formatOptions": {
                "showIcon": true
              }
            },
            {
              "columnMatch": "Change",
              "formatter": 18,
              "formatOptions": {
                "showIcon": true,
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "<",
                    "thresholdValue": "0",
                    "representation": "down",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": ">",
                    "thresholdValue": "0",
                    "representation": "up",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "more",
                    "text": "{0}{1}"
                  }
                ]
              },
              "numberFormat": {
                "unit": 1,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ],
          "labelSettings": [
            {
              "columnId": "Change",
              "label": "Change (%)"
            }
          ]
        },
        "sortBy": []
      },
      "customWidth": "33",
      "name": "query - 14"
    }
  ],
  "fromTemplateId": "IoT-Alerts",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}