{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Recorded Future Playbook Alerts\n---\n\nWorkbook to display and analyze Recorded Future Playbook Alerts. This workbook visualizes data that is retrieved by the ```Recorded Future Playbook Alerts Importer``` Logic app. First run the Logic app once and then select the RecordedFuturePlaybookAlerts_V2_CL table.",
        "style": "info"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "8e8c2f1a-d25d-49d1-a217-9831dbc4f919",
            "version": "KqlParameterItem/1.0",
            "name": "time_picker",
            "label": "Time Picker",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 259200000
            }
          },
          {
            "id": "f8d34a51-ba10-4241-abff-cb6c14b50a55",
            "version": "KqlParameterItem/1.0",
            "name": "log_table",
            "label": "Playbook Alerts Log Table",
            "type": 2,
            "description": "Run the Recorded Future Playbook Alert Importer Playbook first.",
            "isRequired": true,
            "query": "search *\n| where $table endswith \"_CL\" \n| distinct $table\n",
            "timeContext": {
              "durationMs": 604800000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": "RecordedFuturePlaybookAlerts_V2_CL"
          },
          {
            "id": "89279a9c-af9e-4734-8a98-21aa1f2fa545",
            "version": "KqlParameterItem/1.0",
            "name": "categories",
            "label": "Category",
            "type": 2,
            "description": "Filter categories you're looking at",
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "{log_table}\n| distinct rule_label",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "time_picker",
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "a0947450-1ebd-4dea-94d7-41a751c79237",
            "version": "KqlParameterItem/1.0",
            "name": "status",
            "label": "Alert Status",
            "type": 2,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "{log_table}\n| distinct status",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "25a82661-1700-43a6-ba7a-b3ae5d8fe7b9",
            "version": "KqlParameterItem/1.0",
            "name": "priority",
            "label": "Alert Priority",
            "type": 2,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "{log_table}\n| distinct priority",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 172800000
            },
            "timeContextFromParameter": "time_picker",
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "{log_table:value}\n| where rule_label in ({categories:value})\n| where status in ({status:value}) \n| where priority in ({priority:value})\n| distinct id, rule_label, updated_date, priority\n| summarize Alert=count() by bin(updated_date, 1h), priority\n",
        "size": 0,
        "title": "Playbook Alerts triggered over time",
        "timeContextFromParameter": "time_picker",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "chartSettings": {
          "group": "priority",
          "createOtherGroup": null
        }
      },
      "customWidth": "50",
      "name": "query - 2 - Copy",
      "styleSettings": {
        "maxWidth": "70"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "{log_table:value}\n| where rule_label in ({categories:value})\n| where status in ({status:value}) \n| where priority in ({priority:value})\n| distinct id, rule_label, updated_date\n| summarize alert_count = count() by rule_label\n| project alert_count, Alert = rule_label",
        "size": 0,
        "title": "Top Categories Triggered",
        "timeContextFromParameter": "time_picker",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - 2",
      "styleSettings": {
        "maxWidth": "30"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "{log_table:value}\n| where rule_label in ({categories:value})\n| where status in ({status:value}) \n| where priority in ({priority:value})\n| distinct updated_date, alert_title, rule_label, status, priority, link, evidence_summary, targets, created_date, id\n| project-rename Updated=updated_date, Title=alert_title, Category=rule_label, Status=status, Priority=priority, Created=created_date, Targets=targets, [\"Evidence\"]=evidence_summary, [\"External Link\"]=link\n\n",
        "size": 0,
        "title": "Triggered Playbook Alerts",
        "noDataMessage": "No data in Playbook Alert custom log. Check that playbook/logic apps is running without errors and rules for playbook alerts is setup in Recorded Future Portal.",
        "timeContextFromParameter": "time_picker",
        "exportFieldName": "id",
        "exportParameterName": "exported_alert_id",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Title",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "GenericDetails",
                "linkIsContextBlade": true
              }
            },
            {
              "columnMatch": "Link",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "Url",
                "linkLabel": "Recorded Future"
              }
            },
            {
              "columnMatch": "ID",
              "formatter": 5
            }
          ],
          "sortBy": [
            {
              "itemKey": "Updated",
              "sortOrder": 2
            }
          ]
        },
        "sortBy": [
          {
            "itemKey": "Updated",
            "sortOrder": 2
          }
        ]
      },
      "name": "query - 8"
    }
  ],
  "fromTemplateId": "sentinel-RecordedFuturePlaybookAlertOverviewWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}