{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## TrendAI Vision One - Workbench Alerts\n---\n[TrendAI Success Portal](https://success.trendmicro.com)\n\nIf you have any feedback, please send to <xdrfeedback@trendmicro.com>"
      },
      "name": "text - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendAI_XDR_WORKBENCH_V2_CL\n| where TimeGenerated >= ago(7d)\n| summarize Alerts = count() by bin(TimeGenerated,1d), severity_s\n| render columnchart kind=stacked",
        "size": 0,
        "title": "Workbench Alerts Last 7 Days",
        "timeContext": { "durationMs": 604800000 },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "chartSettings": {
          "seriesLabelSettings": [
            { "seriesName": "low",      "label": "Low",      "color": "yellow"   },
            { "seriesName": "medium",   "label": "Medium",   "color": "orange"   },
            { "seriesName": "high",     "label": "High",     "color": "redBright"},
            { "seriesName": "critical", "label": "Critical", "color": "redDark"  }
          ]
        }
      },
      "name": "query - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendAI_XDR_WORKBENCH_V2_CL\n| where TimeGenerated >= ago(30d)\n| summarize Alerts = count() by bin(TimeGenerated,1d), severity_s\n| render columnchart kind=stacked",
        "size": 0,
        "title": "Workbench Alerts Last 30 Days",
        "timeContext": { "durationMs": 2592000000 },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "chartSettings": {
          "seriesLabelSettings": [
            { "seriesName": "low",      "label": "Low",      "color": "yellow"   },
            { "seriesName": "medium",   "label": "Medium",   "color": "orange"   },
            { "seriesName": "high",     "label": "High",     "color": "redBright"},
            { "seriesName": "critical", "label": "Critical", "color": "redDark"  }
          ]
        }
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendAI_XDR_WORKBENCH_V2_CL\n| summarize Alerts = count() by severity_s\n| render piechart",
        "size": 0,
        "title": "Alerts by Severity",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "chartSettings": {
          "seriesLabelSettings": [
            { "seriesName": "low",      "label": "Low",      "color": "yellow"   },
            { "seriesName": "medium",   "label": "Medium",   "color": "orange"   },
            { "seriesName": "high",     "label": "High",     "color": "redBright"},
            { "seriesName": "critical", "label": "Critical", "color": "redDark"  }
          ]
        }
      },
      "name": "query - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendAI_XDR_WORKBENCH_V2_CL\n| where TimeGenerated >= ago(30d)\n| summarize Alerts = count() by bin(TimeGenerated,1d), model_s\n| render columnchart kind=stacked",
        "size": 0,
        "title": "Detection Models Last 30 Days",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TrendAI_XDR_WORKBENCH_V2_CL\n| where isnotempty(HostHostName_s) and HostHostName_s != '[]'\n| summarize Alerts = count() by HostHostName_s\n| top 10 by Alerts desc",
        "size": 0,
        "title": "Top 10 Affected Hosts",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 5"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-TrendAIVisionOneWorkbench",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}