{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## ARGOS Cloud Security\n---\n\nWelcome to your ARGOS Cloud Security notebook.\nThis notebook will get you started with basic queries and graphs displaying security issues in your cloud environments.\n Access the ARGOS Dashboard on https://app.argos-security.io"
        },
        "name": "text - 2"
      },
      {
        "type": 1,
        "content": {
          "json": "## Overview of currently open detections grouped by rule ID\r\n\r\nThis chart is applied across all cloud environments connected to ARGOS.",
          "style": "info"
        },
        "name": "text - 8"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "ARGOS_CL | where status_s == 'open' | summarize count() by ruleId_s | render barchart",
          "size": 0,
          "timeContext": {
            "durationMs": 2592000000
          },
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "query - 7"
      },
      {
        "type": 1,
        "content": {
          "json": "## Display all exploitable ARGOS Detections.\r\n\r\nThis displays all detections that ARGOS ruled as being currently exploitable.",
          "style": "warning"
        },
        "name": "text - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "ARGOS_CL | where exploitable_b",
          "size": 0,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "TenantId",
                "formatter": 5
              },
              {
                "columnMatch": "SourceSystem",
                "formatter": 5
              },
              {
                "columnMatch": "MG",
                "formatter": 5
              },
              {
                "columnMatch": "ManagementGroupName",
                "formatter": 5
              },
              {
                "columnMatch": "Computer",
                "formatter": 5
              },
              {
                "columnMatch": "RawData",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_policy_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_tlsVersion_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleName_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleDirection_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleSourcePortRange_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleSourcePortRanges_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleDestinationPortRange_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleDestinationPortRanges_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleSourceAddressPrefix_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleSourceAddressPrefixes_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleDestinationAddressPrefix_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleDestinationAddressPrefixes_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleProtocol_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_ruleAction_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_rulePriority_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_region_s",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_registryId_s",
                "formatter": 5
              },
              {
                "columnMatch": "inventoryId_g",
                "formatter": 5
              },
              {
                "columnMatch": "metadata_id_s",
                "formatter": 5
              }
            ]
          }
        },
        "name": "query - 2"
      },
      {
        "type": 1,
        "content": {
          "json": "### Render a time chart with all exploitable ARGOS detections.",
          "style": "warning"
        },
        "name": "text - 4"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "ARGOS_CL | where exploitable_b | summarize count() by TimeGenerated | render timechart",
          "size": 0,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "query - 3"
      },
      {
        "type": 1,
        "content": {
          "json": "## Display Top 10, open, exploitable ARGOS Detections on Azure.\r\n\r\nThis is a list of the top 10, open rules that ARGOS detected in your cloud environments. The higher the count, the more detections are currently open for this rule.",
          "style": "warning"
        },
        "name": "text - 5"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "ARGOS_CL | where cloud_s == 'azure' and status_s == 'open' and exploitable_b | summarize count() by ruleId_s | top 10 by count_",
          "size": 0,
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "query - 6"
      }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-ArgosCloudSecurityWorkbook",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }