{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Island Enterprise Browser User Activity Overview"
      },
      "name": "text - 0"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "e246fdd8-f37f-4290-a205-7ffa192ea860",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          },
          {
            "id": "fe452f11-ddc9-4b85-b441-b8f6be3b33a8",
            "version": "KqlParameterItem/1.0",
            "name": "User",
            "type": 2,
            "description": "To Select the User or Users to Filter on",
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "Island_User_CL\r\n| distinct userName_s\r\n| project Value = userName_s",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "selectAllValue": "All",
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where type_s == \"Navigation\"\r\n| extend Domain = tostring(parse_url(topLevelUrl_s).Host)\r\n| where Domain !=\"\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count = count() by Domain\r\n| order by Count desc",
        "size": 0,
        "title": "Top URLs by FQDN",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "DestinationServiceName",
        "exportParameterName": "DestinationServiceNameFilter",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "min": 0,
                "palette": "purple",
                "showIcon": true
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "33",
      "name": "query - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where type_s == \"Navigation\"\r\n| extend WebCategory = todynamic(urlWebCategories_s)\r\n| mv-expand WebCategory\r\n| where WebCategory  !=\"\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count = count() by tostring(WebCategory)\r\n| order by Count desc",
        "size": 0,
        "title": "Top Web Categories",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "33",
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\n| where ruleName_s  !=\"\"\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\n| summarize Count = count() by RuleName=ruleName_s\n| order by Count desc",
        "size": 0,
        "title": "Top Rules",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "33",
      "name": "query - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where urlWebReputation_d >= 0\r\n| summarize Count = count() by urlWebReputation_d\r\n| project  URL_Risk = urlWebReputation_d, Count\r\n| order by URL_Risk desc",
        "size": 0,
        "title": "URL Risk (100 - Low Risk, 0 - High Risk)",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "min": 0,
                "palette": "greenBlue",
                "showIcon": true
              }
            }
          ],
          "filter": true
        },
        "chartSettings": {
          "showMetrics": false
        }
      },
      "customWidth": "33",
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where type_s == \"Navigation\"\r\n| where saasApplicationCategory_s !=\"\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count = count() by saasApplicationCategory_s\r\n| order by Count desc",
        "size": 2,
        "title": "Top SaaS Application Categories",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "Location",
        "exportParameterName": "LocationFilter",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Downloads",
              "formatter": 4,
              "formatOptions": {
                "min": 0,
                "palette": "blue",
                "showIcon": true
              }
            },
            {
              "columnMatch": "Uploads",
              "formatter": 4,
              "formatOptions": {
                "palette": "green",
                "showIcon": true
              }
            }
          ]
        }
      },
      "customWidth": "33",
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where type_s == \"Navigation\"\r\n| where saasApplicationName_s !=\"\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count = count() by saasApplicationName_s\r\n| order by Count desc",
        "size": 2,
        "title": "Top SaaS Applications",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "query - 5"
    },
    {
      "type": 1,
      "content": {
        "json": "---\r\n### Block actvities"
      },
      "name": "text - 10"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where verdict_s == \"Blocked\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count = count() by type_s",
        "size": 2,
        "title": "Blocked Action Types",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "DestinationHostName",
        "exportParameterName": "DestinationHostName",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ]
        }
      },
      "customWidth": "33",
      "name": "query - 16"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where verdict_s == \"Blocked\"\r\n| extend Domain = tostring(parse_url(topLevelUrl_s).Host)\r\n| where Domain !=\"\"\r\n| where (userName_s in ({User}) or '{User:label}' == \"All\")\r\n| summarize Count=count() by Domain, Action=type_s",
        "size": 2,
        "title": "Blocked URL Domains by Actions",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "SourceUserName",
        "exportParameterName": "SourceUserName",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ],
          "rowLimit": 1000
        },
        "chartSettings": {
          "showMetrics": false,
          "showLegend": true,
          "ySettings": {
            "numberFormatSettings": {
              "unit": 0,
              "options": {
                "style": "decimal",
                "useGrouping": true
              }
            }
          }
        }
      },
      "customWidth": "33",
      "name": "query - 12"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Island_User_CL\r\n| where verdict_s == \"Blocked\"\r\n| summarize Count = count() by Username=userName_s\r\n",
        "size": 2,
        "title": "Blocked Users",
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "Activity",
        "exportParameterName": "Activity",
        "exportDefaultValue": "All",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot",
                "showIcon": true
              }
            }
          ]
        }
      },
      "customWidth": "33",
      "name": "query - 13"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}