{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Recorded Future Alerts\n---\n\nWorkbook to display and analyze Recorded Future Alerts. This workbook visualizes data that is retrieved by the ```Recorded Future Alerts Importer``` Logic app. First run the Logic app once and then select the RecordedFutureClassicAlerts_V2_CL table.",
        "style": "info"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8e8c2f1a-d25d-49d1-a217-9831dbc4f919",
            "version": "KqlParameterItem/1.0",
            "name": "time_picker",
            "label": "Time Picker",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          },
          {
            "id": "f8d34a51-ba10-4241-abff-cb6c14b50a55",
            "version": "KqlParameterItem/1.0",
            "name": "log_table",
            "label": "Alerts Log Table",
            "type": 2,
            "isRequired": true,
            "query": "search \"*\" | summarize count() by $table | sort by count_ desc | where $table endswith \"CL\" | project $table",
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "time_picker",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": "RecordedFutureClassicAlerts_V2_CL"
          },
          {
            "id": "89279a9c-af9e-4734-8a98-21aa1f2fa545",
            "version": "KqlParameterItem/1.0",
            "name": "alert_rules",
            "label": "Alert Rules",
            "type": 2,
            "description": "Filter alert rules you're looking at",
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "{log_table}\n| distinct RuleName",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "time_picker",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "{log_table:value}\n| where RuleName in ({alert_rules:value})\n| distinct AlertID, RuleName, Triggered\n| summarize alert_count = count() by RuleName\n| project alert_count, Alert = RuleName\n",
        "size": 0,
        "title": "Top Rules Triggered",
        "noDataMessage": "There are no alerts within this time frame.",
        "timeContextFromParameter": "time_picker",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - 2",
      "styleSettings": {
        "maxWidth": "30"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "{log_table:value}\n| where RuleName in ({alert_rules:value})\n| distinct AlertID, RuleName, Triggered\n| summarize Alert=count() by bin(Triggered, 1h)\n",
        "size": 0,
        "title": "Alerts triggered over time",
        "timeContextFromParameter": "time_picker",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "customWidth": "50",
      "name": "query - 2 - Copy",
      "styleSettings": {
        "maxWidth": "70"
      }
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "20edde78-9485-4056-8eca-6ef7cd86c8b5",
            "cellValue": "TAB",
            "linkTarget": "parameter",
            "linkLabel": "Alert",
            "subTarget": "Reference",
            "preText": "Some thing",
            "postText": "Some thing",
            "style": "link"
          }
        ]
      },
      "name": "links - 5"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "{log_table:value}\n| where RuleName in ({alert_rules:value})\n//| where Documents_s != \"[]\"\n//| distinct AlertID, AlertName, Documents_s, Entity_description_s, Entity_id_s, Entity_name_s, Entity_type_s, Risk_criticalityLabel_s, \n//Risk_criticality_d, Risk_documents_s, Risk_evidence_s, RuleName, Trend_documents_s, Trend_name_s, Trend_strengthLabel_s, Trend_strength_d, Triggered\n| distinct  Triggered = Triggered, [\"Alert ID\"]=AlertID, [\"Alert Name\"]=AlertName, [\"Rule Name\"]=RuleName, [\"AI Summary\"]= AISummary, [\"Recorded Future Portal\"]= URL\n\n\n\n",
              "size": 0,
              "timeContextFromParameter": "time_picker",
              "exportFieldName": "Alert ID",
              "exportParameterName": "Ref_AlertID",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Alert ID",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "GenericDetails",
                      "linkIsContextBlade": true
                    }
                  },
                  {
                    "columnMatch": "AI Summary",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "CellDetails",
                      "linkIsContextBlade": true
                    }
                  },
                  {
                    "columnMatch": "Recorded Future Portal",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "Url",
                      "linkLabel": "Recorded Future"
                    }
                  }
                ],
                "sortBy": [
                  {
                    "itemKey": "Triggered",
                    "sortOrder": 2
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "Triggered",
                  "sortOrder": 2
                }
              ]
            },
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "{log_table:value}\n| where AlertID == \"{Ref_AlertID}\"\n| project Fragment=Fragment, Source=tostring(Documents[\"source_name\"]), Title=tostring(Documents[\"title\"]), URL=Document_url, AlertName = RuleName, AlertID=AlertID, entities=parse_json(tostring(Entity))\n| mv-apply with_itemindex=i entities on (\n    extend p = pack(strcat(\"Entity \", i+1), strcat(entities.type, \", \", entities.name, \", id:\", entities.id))\n    | summarize b = make_bag(p)\n)\n| evaluate bag_unpack(b)\n| project-reorder Fragment, Source, Title, URL, Entity*\n\n",
              "size": 0,
              "timeContextFromParameter": "time_picker",
              "exportedParameters": [
                {
                  "fieldName": "Fragment",
                  "parameterName": "FragmentRef",
                  "parameterType": 1
                },
                {
                  "fieldName": "Title",
                  "parameterName": "TitleRef",
                  "parameterType": 1
                }
              ],
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Fragment",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "GenericDetails",
                      "linkIsContextBlade": true
                    },
                    "tooltipFormat": {
                      "tooltip": "{0}"
                    }
                  }
                ]
              }
            },
            "conditionalVisibility": {
              "parameterName": "TAB",
              "comparison": "isEqualTo",
              "value": "Reference"
            },
            "name": "Reference View"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "**Document Title**\r\n{TitleRef}"
                  },
                  "name": "text - 3"
                },
                {
                  "type": 1,
                  "content": {
                    "json": "**Fragment**\r\n{FragmentRef}\r\n\r\n\r\n"
                  },
                  "showPin": false,
                  "name": "Fragment"
                }
              ]
            },
            "name": "group - 4"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "TAB",
        "comparison": "isEqualTo",
        "value": "Reference"
      },
      "name": "Reference Alerts"
    }
  ],
  "fromTemplateId": "sentinel-RecordedFutureAlertOverviewWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}