{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Microsoft Defender for Identity\n---\n"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "crossComponentResources": [],
        "parameters": [
          {
            "id": "6e647d99-1a32-4bca-8147-403b5d37d773",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "isRequired": true,
            "value": "",
            "typeSettings": {
              "additionalResourceOptions": [],
              "includeAll": false,
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "timeContextFromParameter": "TimeRange"
          },
          {
            "id": "d57bcdf5-aec7-4f86-904c-67171864919b",
            "version": "KqlParameterItem/1.0",
            "name": "Workspace",
            "type": 5,
            "isRequired": true,
            "query": "resources\r\n| where type =~ \"microsoft.operationalinsights/workspaces\"",
            "crossComponentResources": [
              "{Subscription}"
            ],
            "typeSettings": {
              "resourceTypeFilter": {
                "microsoft.operationalinsights/workspaces": true
              },
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "2e238f92-709c-410b-93e0-60eab6150a75",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 1800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "ec13514a-7e54-4d41-86db-2805727a2fa7",
            "version": "KqlParameterItem/1.0",
            "name": "About",
            "type": 10,
            "description": "",
            "isRequired": true,
            "value": "Show",
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "jsonData": "[\r\n    \"Show\",\r\n    \"Hide\"\r\n]"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.resourcegraph/resources"
      },
      "name": "parameters - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "### Microsoft Defender for Identity Analysis Workbook\r\n\r\n",
              "style": "info"
            },
            "name": "text - 0"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "About",
        "comparison": "isEqualTo",
        "value": "Show"
      },
      "name": "AboutGroup"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "48578fe1-da47-4a4c-b495-ce7fe24ce495",
            "cellValue": "Nav",
            "linkTarget": "parameter",
            "linkLabel": "Overview",
            "subTarget": "grpOverview",
            "style": "link"
          },
          {
            "id": "30e93159-8bf5-4006-820f-406ea10bcd17",
            "cellValue": "Nav",
            "linkTarget": "parameter",
            "linkLabel": "LogOnEvents",
            "subTarget": "grpLogOnEvents",
            "style": "link"
          },
          {
            "id": "c40f76ed-94be-40ff-b65b-3fda306f2c3d",
            "cellValue": "Nav",
            "linkTarget": "parameter",
            "linkLabel": "QueryEvents",
            "subTarget": "grpQueryEvents",
            "style": "link"
          },
          {
            "id": "38c88a53-f7b1-42da-83d6-0c809835eaab",
            "cellValue": "Nav",
            "linkTarget": "parameter",
            "linkLabel": "DirectoryEvents",
            "subTarget": "grpDirectoryEvents",
            "style": "link"
          },
          {
            "id": "0ad83579-c492-4c20-8db6-27883db5abc8",
            "cellValue": "Nav",
            "linkTarget": "parameter",
            "linkLabel": "Alerts",
            "subTarget": "grpAlerts",
            "style": "link"
          }
        ]
      },
      "name": "links - 8"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n| summarize count() by LogonType",
              "size": 0,
              "title": "Log On Summary",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "tiles",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "LogonType",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "customWidth": "40",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n|summarize count() by ActionType",
              "size": 0,
              "title": "Log On Status",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "piechart"
            },
            "customWidth": "30",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n| summarize count() by Protocol",
              "size": 0,
              "title": "Log On Protocol",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "barchart"
            },
            "customWidth": "30",
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityQueryEvents\r\n| summarize count() by Protocol",
              "size": 0,
              "title": "Query Summary",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "barchart"
            },
            "customWidth": "30",
            "name": "query - 3"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityQueryEvents\r\n| summarize count() by DestinationPort",
              "size": 0,
              "title": "Query Destination Port",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "piechart"
            },
            "customWidth": "30",
            "name": "query - 3 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityQueryEvents\r\n| where isnotempty(QueryType)\r\n| summarize count() by QueryType\r\n| order by count_ desc\r\n| take 10",
              "size": 0,
              "title": "Top 10 Query Types",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ]
              }
            },
            "customWidth": "30",
            "name": "query - 7"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| summarize count() by Protocol",
              "size": 0,
              "title": "Directory Events Protocol",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "categoricalbar"
            },
            "customWidth": "40",
            "name": "query - 6"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| summarize count() by AccountDomain",
              "size": 0,
              "title": "Directory Events Protocol",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "piechart"
            },
            "customWidth": "30",
            "name": "query - 6 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| where isnotempty(AccountUpn)\r\n| summarize count() by AccountUpn\r\n| order by count_ desc \r\n| take 10",
              "size": 0,
              "title": "Top 10 Accounts Activity",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "customWidth": "30",
            "name": "query - 6 - Copy - Copy"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Nav",
        "comparison": "isEqualTo",
        "value": "grpOverview"
      },
      "name": "grpOverview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n| where LogonType == \"Resource access\"\r\n| extend FROM_DEVICE_ = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE_ = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by FROM_DEVICE_, TO_DEVICE_\r\n| order by sum_Count_ desc",
              "size": 0,
              "title": "Resource Access Summary in Devices",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "sum_Count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "customWidth": "45",
            "name": "query - 0",
            "styleSettings": {
              "margin": "5px",
              "padding": "5px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n| where LogonType == \"Resource access\"\r\n| extend TargetComputerOperatingSystem_ = tostring(AdditionalFields.TargetComputerOperatingSystem)\r\n| extend DestinationComputerOperatingSystem_ = tostring(AdditionalFields.DestinationComputerOperatingSystem)\r\n| extend Count_ = toint(AdditionalFields.Count)\r\n| summarize sum(Count_) by TargetComputerOperatingSystem_, DestinationComputerOperatingSystem_\r\n| order by sum_Count_ desc",
              "size": 0,
              "title": "Resource Access Summary in OS",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "sum_Count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "customWidth": "45",
            "name": "query - 0 - Copy",
            "styleSettings": {
              "margin": "5px",
              "padding": "5px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityLogonEvents\r\n| where LogonType == \"Credentials validation\"\r\n| extend FROM_DEVICE = tostring(AdditionalFields.[\"FROM.DEVICE\"])\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize sum(Count) by FROM_DEVICE, TO_DEVICE\r\n| order by sum_Count desc",
              "size": 0,
              "title": "Credentials validation Summary in Devices",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "sum_Count",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "customWidth": "45",
            "name": "query - 0 - Copy",
            "styleSettings": {
              "margin": "5px",
              "padding": "5px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = IdentityLogonEvents\r\n| where LogonType == \"Credentials validation\"\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"])\r\n| extend Count = toint(AdditionalFields.Count);\r\ndata\r\n| summarize sum(Count) by  TO_DEVICE\r\n| order by sum_Count desc\r\n| join kind=inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by TO_DEVICE\r\n)\r\non $left.TO_DEVICE == $right.TO_DEVICE",
              "size": 0,
              "title": "Credentials validation by Domain Controllers",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "sum_Count",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TO_DEVICE1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 10,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "customWidth": "45",
            "name": "query - 0 - Copy - Copy",
            "styleSettings": {
              "margin": "5px",
              "padding": "5px",
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = IdentityLogonEvents;\r\ndata\r\n| extend Count = toint(AdditionalFields.Count)\r\n| summarize LogonSuccess = sumif(Count,ActionType == \"LogonSuccess\"),LogonFailed= sumif(Count,ActionType == \"LogonFailed\") by AccountUpn\r\n| join kind = inner\r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn\r\n) on $left.AccountUpn == $right.AccountUpn",
              "size": 0,
              "title": "Logon Summary by Users",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "LogonSuccess",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "LogonFailed",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "redPurple"
                    }
                  },
                  {
                    "columnMatch": "AccountUpn1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 0 - Copy - Copy"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Nav",
        "comparison": "isEqualTo",
        "value": "grpLogOnEvents"
      },
      "name": "AttachmentGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = IdentityQueryEvents\r\n| extend TO_DEVICE = tostring(AdditionalFields.[\"TO.DEVICE\"]);\r\ndata\r\n| summarize count() by QueryType, TO_DEVICE\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by QueryType, TO_DEVICE\r\n) on $left.QueryType == $right.QueryType and $left.TO_DEVICE== $right.TO_DEVICE",
              "size": 0,
              "title": "Device Query Summary",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "TO_DEVICE",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "QueryType1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "TO_DEVICE1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "hierarchySettings": {
                  "treeType": 1,
                  "groupBy": [
                    "TO_DEVICE"
                  ],
                  "expandTopLevel": true
                }
              }
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = IdentityQueryEvents;\r\ndata\r\n| summarize count() by DeviceName\r\n| join kind =inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DeviceName\r\n) on $left.DeviceName == $right.DeviceName",
              "size": 0,
              "title": "Query Summary from Source Devices",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "DeviceName1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 0 - Copy"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Nav",
        "comparison": "isEqualTo",
        "value": "grpQueryEvents"
      },
      "name": "UrlGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActionType ",
              "size": 0,
              "title": "Timeline on ActionType",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "timechart"
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| summarize count() by ActionType \r\n| order by count_ desc",
              "size": 0,
              "title": "Top 10 Actions",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "categoricalbar",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Trend",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ]
              },
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "DestinationPort",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "name": "query - 0 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "IdentityDirectoryEvents\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AccountUpn",
              "size": 0,
              "title": "Account Trend on Directory Events",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Trend",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              },
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "DestinationPort",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "name": "query - 0 - Copy - Copy"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Nav",
        "comparison": "isEqualTo",
        "value": "grpDirectoryEvents"
      },
      "name": "group - 8"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId;\r\ndata\r\n| summarize count() by AlertName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by AlertName\r\n) on AlertName",
              "size": 0,
              "noDataMessage": "Alerts",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "red"
                    }
                  },
                  {
                    "columnMatch": "AlertName1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "red"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ]
              }
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = SecurityAlert\r\n| where ProductName == \"Azure Advanced Threat Protection\"\r\n| summarize arg_max(TimeGenerated,*) by SystemAlertId\r\n| mv-expand todynamic(Entities)\r\n| where Entities[\"Type\"] == \"host\"\r\n| where isnotempty(Entities[\"HostName\"])\r\n| extend HostName = tostring(Entities[\"HostName\"]);\r\ndata\r\n| summarize count() by HostName\r\n| join kind=inner \r\n(\r\ndata\r\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by HostName\r\n) on $left.HostName == $right.HostName",
              "size": 0,
              "title": "Impacted Hosts",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": ["{Workspace}"],
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "count_",
                    "formatter": 8,
                    "formatOptions": {
                      "palette": "red"
                    }
                  },
                  {
                    "columnMatch": "HostName1",
                    "formatter": 5
                  },
                  {
                    "columnMatch": "Trend",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "red"
                    }
                  },
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 5
                  }
                ]
              }
            },
            "name": "query - 1"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Nav",
        "comparison": "isEqualTo",
        "value": "grpAlerts"
      },
      "name": "group - 8"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-MicrosoftDefenderForIdentity",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}