{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "3f8a1c74-2b95-4d0e-9a63-5c81df427e10",
            "cellValue": "SelectedTab",
            "linkTarget": "parameter",
            "linkLabel": "File Overview",
            "subTarget": "fileoverview",
            "style": "link"
          },
          {
            "id": "b6d40e92-71a8-4f3c-8e57-2a9b0c6d1834",
            "cellValue": "SelectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Extension Overview",
            "subTarget": "extoverview",
            "style": "link"
          },
          {
            "id": "e21c5b38-9d46-4a70-b1f9-7c3e0a85d2b6",
            "cellValue": "SelectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Server Activity",
            "subTarget": "svractivity",
            "style": "link"
          },
          {
            "id": "a94f7d61-38e2-4c58-9b0a-6d1f5e83c7a2",
            "cellValue": "SelectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Execution History",
            "subTarget": "realtime",
            "style": "link"
          }
        ]
      },
      "name": "tabs-nav"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "c978de7c-42fb-4470-98be-0ff5e4c6958f",
            "version": "KqlParameterItem/1.0",
            "name": "TimeSelector",
            "label": "Time Selector",
            "type": 2,
            "isRequired": true,
            "query": "datatable(value:string, label:string, ord:long)[\n    \"startofday(now())\",\"Today\",0,\n    \"ago(1d)\",\"Last 24 Hours\",1,\n    \"ago(7d)\",\"Last 7 Days\",2,\n    \"ago(30d)\",\"Last 30 Days\",3,\n    \"ago(90d)\",\"Last 90 Days\",4,\n    \"datetime(2000-01-01)\",\"All Time\",5\n]\n| order by ord asc\n| project value, label",
            "value": "ago(90d)",
            "typeSettings": {
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 315360000000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "f19551e2-9ac4-4e1a-b93d-3473152c5a60",
            "version": "KqlParameterItem/1.0",
            "name": "PolicyGroup",
            "label": "Policy Group / Name Filter",
            "type": 2,
            "isRequired": true,
            "query": "let policies = ASimProcessEventAirlockDigital\n| where isnotempty(RuleName)\n| distinct RuleName\n| extend ord = 1;\nunion (datatable(RuleName:string, ord:long)['All', 0]), policies\n| order by ord asc, RuleName asc\n| project RuleName",
            "value": "All",
            "typeSettings": {
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 315360000000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "44152db0-0fc5-45ca-b188-5675c9cb6132",
            "version": "KqlParameterItem/1.0",
            "name": "ExecutionType",
            "label": "Execution Type Filter",
            "type": 2,
            "isRequired": true,
            "query": "datatable(value:string, label:string, ord:long)[\n    \"All\",\"All\",0,\n    \"0\",\"Trusted Execution\",1,\n    \"1\",\"Blocked Execution\",2,\n    \"2\",\"Untrusted Execution [Audit]\",3,\n    \"3\",\"Untrusted Execution [OTP]\",4,\n    \"4\",\"Trusted Path Execution\",5,\n    \"5\",\"Trusted Publisher Execution\",6,\n    \"6\",\"Blocklist Execution\",7,\n    \"7\",\"Blocklist Execution [Audit]\",8,\n    \"8\",\"Trusted Process Execution\",9,\n    \"9\",\"Constrained Execution\",10,\n    \"10\",\"Trusted Metadata Execution\",11,\n    \"11\",\"Trusted Browser Execution\",12,\n    \"12\",\"Blocked Browser Execution\",13,\n    \"13\",\"Untrusted Browser Execution [Audit]\",14,\n    \"14\",\"Untrusted Browser Execution [OTP]\",15,\n    \"15\",\"Blocklist Browser Execution [Audit]\",16,\n    \"16\",\"Blocklist Browser Execution\",17,\n    \"17\",\"Trusted Installer Execution\",18,\n    \"18\",\"Trusted Browser Metadata Execution\",19\n]\n| order by ord asc\n| project value, label",
            "value": "All",
            "typeSettings": {
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 315360000000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "params-filters"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend EventTypeName = case(\n    EventOriginalType == '0', 'Trusted Execution',\n    EventOriginalType == '1', 'Blocked Execution',\n    EventOriginalType == '2', 'Untrusted Execution [Audit]',\n    EventOriginalType == '3', 'Untrusted Execution [OTP]',\n    EventOriginalType == '4', 'Trusted Path Execution',\n    EventOriginalType == '5', 'Trusted Publisher Execution',\n    EventOriginalType == '6', 'Blocklist Execution',\n    EventOriginalType == '7', 'Blocklist Execution [Audit]',\n    EventOriginalType == '8', 'Trusted Process Execution',\n    EventOriginalType == '9', 'Constrained Execution',\n    EventOriginalType == '10', 'Trusted Metadata Execution',\n    EventOriginalType == '11', 'Trusted Browser Execution',\n    EventOriginalType == '12', 'Blocked Browser Execution',\n    EventOriginalType == '13', 'Untrusted Browser Execution [Audit]',\n    EventOriginalType == '14', 'Untrusted Browser Execution [OTP]',\n    EventOriginalType == '15', 'Blocklist Browser Execution [Audit]',\n    EventOriginalType == '16', 'Blocklist Browser Execution',\n    EventOriginalType == '17', 'Trusted Installer Execution',\n    EventOriginalType == '18', 'Trusted Browser Metadata Execution',\n    isnotempty(EventOriginalType), EventOriginalType,\n    strcat('Unknown (', EventOriginalType, ')'))\n| summarize Count = count() by EventTypeName\n| order by Count desc",
              "size": 0,
              "title": "Execution Types",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "33",
            "name": "fo_exec_types"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let data = ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}';\nunion\n    (data | where (EventOriginalType in ('1','6','7','12','15','16') or EventOriginalType has_any ('Blocked', 'Blocklist')) | summarize Value = count() | extend Metric = 'Blocked Executions (Total)', Mode = 'Total', Category = 'Blocked', ord = 0),\n    (data | where (EventOriginalType in ('1','6','7','12','15','16') or EventOriginalType has_any ('Blocked', 'Blocklist')) | summarize Value = dcount(TargetProcessSHA256) | extend Metric = 'Blocked Executions (Unique)', Mode = 'Unique', Category = 'Blocked', ord = 1),\n    (data | where (EventOriginalType in ('2','3','9','13','14') or EventOriginalType has_any ('Untrusted', 'Constrained')) | summarize Value = count() | extend Metric = 'Untrusted Executions (Total)', Mode = 'Total', Category = 'Untrusted', ord = 2),\n    (data | where (EventOriginalType in ('2','3','9','13','14') or EventOriginalType has_any ('Untrusted', 'Constrained')) | summarize Value = dcount(TargetProcessName) | extend Metric = 'Untrusted Executions (Unique)', Mode = 'Unique', Category = 'Untrusted', ord = 3)\n| order by ord asc\n| project Metric, Value, Mode, Category\n",
              "size": 0,
              "title": "Blocked / Untrusted Files",
              "timeContext": {
                "durationMs": 315360000000
              },
              "exportedParameters": [
                {
                  "fieldName": "Metric",
                  "parameterName": "SelectedMetric",
                  "defaultValue": ""
                },
                {
                  "fieldName": "Mode",
                  "parameterName": "MetricMode",
                  "defaultValue": ""
                },
                {
                  "fieldName": "Category",
                  "parameterName": "MetricCategory",
                  "defaultValue": ""
                }
              ],
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Metric",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Value",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "blue"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumFractionDigits": 0
                    }
                  }
                },
                "showBorder": true
              }
            },
            "customWidth": "34",
            "name": "fo_blocked_allowed"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= ago(365d)\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| summarize ['Received Date'] = min(TimeGenerated) by ['File Name'] = TargetProcessName, Publisher = TargetProcessFileCompany\n| where ['Received Date'] >= {TimeSelector}\n| where isnotempty(['File Name'])\n| project ['Received Date'], ['File Name'], Publisher\n| top 100 by ['Received Date'] desc",
              "size": 0,
              "title": "New Files Seen",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "sortBy": [
                  {
                    "itemKey": "Received Date",
                    "sortOrder": 2
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "Received Date",
                  "sortOrder": 2
                }
              ]
            },
            "customWidth": "33",
            "name": "fo_new_files"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let blocked = dynamic(['1','6','7','12','15','16']);\nlet untrusted = dynamic(['2','3','9','13','14']);\nlet cat = '{MetricCategory}';\nASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| where (cat == 'Blocked' and (EventOriginalType in (blocked) or EventOriginalType has_any ('Blocked', 'Blocklist')))\n     or (cat == 'Untrusted' and (EventOriginalType in (untrusted) or EventOriginalType has_any ('Untrusted', 'Constrained')))\n| summarize Executions = count(), ['Last Seen'] = max(TimeGenerated) by ['File Name'] = TargetProcessName, SHA256 = TargetProcessSHA256\n| order by Executions desc\n| take 1000",
              "size": 3,
              "title": "Files for: {SelectedMetric}",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "100",
            "conditionalVisibility": {
              "parameterName": "MetricMode",
              "comparison": "isEqualTo",
              "value": "Unique"
            },
            "name": "fo_blocked_allowed_detail"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let blocked = dynamic(['1','6','7','12','15','16']);\nlet untrusted = dynamic(['2','3','9','13','14']);\nlet cat = '{MetricCategory}';\nASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| where (cat == 'Blocked' and (EventOriginalType in (blocked) or EventOriginalType has_any ('Blocked', 'Blocklist')))\n     or (cat == 'Untrusted' and (EventOriginalType in (untrusted) or EventOriginalType has_any ('Untrusted', 'Constrained')))\n| extend EventTypeName = case(\n    EventOriginalType == '1', 'Blocked Execution',\n    EventOriginalType == '2', 'Untrusted Execution [Audit]',\n    EventOriginalType == '3', 'Untrusted Execution [OTP]',\n    EventOriginalType == '6', 'Blocklist Execution',\n    EventOriginalType == '7', 'Blocklist Execution [Audit]',\n    EventOriginalType == '9', 'Constrained Execution',\n    EventOriginalType == '12', 'Blocked Browser Execution',\n    EventOriginalType == '13', 'Untrusted Browser Execution [Audit]',\n    EventOriginalType == '14', 'Untrusted Browser Execution [OTP]',\n    EventOriginalType == '15', 'Blocklist Browser Execution [Audit]',\n    EventOriginalType == '16', 'Blocklist Browser Execution',\n    EventOriginalType)\n| project TimeGenerated, DvcHostname, ActorUsername, ['File Name'] = TargetProcessName, ['Execution Type'] = EventTypeName, Publisher = TargetProcessFileCompany, RuleName, SHA256 = TargetProcessSHA256\n| order by TimeGenerated desc\n| take 1000",
              "size": 3,
              "title": "Files for: {SelectedMetric}",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "100",
            "conditionalVisibility": {
              "parameterName": "MetricMode",
              "comparison": "isEqualTo",
              "value": "Total"
            },
            "name": "fo_blocked_allowed_detail_total"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| where isnotempty(ActorUsername)\n| summarize Count = count() by ActorUsername\n| order by Count desc\n| take 10",
              "size": 0,
              "title": "Users With Highest Events",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "33",
            "name": "fo_users"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| where isnotempty(DvcHostname)\n| summarize Count = count() by DvcHostname\n| order by Count desc\n| take 10",
              "size": 0,
              "title": "Hostnames With Highest Events",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "34",
            "name": "fo_hosts"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| where isnotempty(RuleName)\n| summarize Count = count() by RuleName\n| order by Count desc\n| take 10",
              "size": 0,
              "title": "Policy Names / Groups With Highest Events",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "33",
            "name": "fo_polgroups"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimAuditEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| project ['Date / Time'] = TimeGenerated, ['Server Task'] = Operation, User = ActorUsername, Description = EventMessage\n| order by ['Date / Time'] desc\n| take 200",
              "size": 0,
              "title": "Server Activity History",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table"
            },
            "customWidth": "100",
            "name": "fo_svr"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "SelectedTab",
        "comparison": "isEqualTo",
        "value": "fileoverview"
      },
      "name": "group-fileoverview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend ExtName = tostring(AdditionalFields.extName)\n| where isnotempty(ExtName)\n| summarize Count = count() by ExtName\n| order by Count desc\n| take 10",
              "size": 0,
              "title": "Extensions With Highest Events",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "name": "ext_name",
            "customWidth": "33"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend ExtType = tostring(AdditionalFields.extType)\n| where isnotempty(ExtType)\n| summarize Count = count() by ExtType\n| order by Count desc",
              "size": 0,
              "title": "Extension Types",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "ext_type",
            "customWidth": "34"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend ExtBrowser = tostring(AdditionalFields.extBrowser)\n| where isnotempty(ExtBrowser)\n| summarize Count = count() by ExtBrowser\n| order by Count desc",
              "size": 0,
              "title": "Extension Browsers",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "ext_browser",
            "customWidth": "33"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend\n    ExtName    = tostring(AdditionalFields.extName),\n    ExtBrowser = tostring(AdditionalFields.extBrowser),\n    ExtType    = tostring(AdditionalFields.extType),\n    ExtId      = tostring(AdditionalFields.extId)\n| where isnotempty(ExtName) or isnotempty(ExtId)\n| project TimeGenerated, DvcHostname, ActorUsername, ExtName, ExtBrowser, ExtType, ExtId\n| order by TimeGenerated desc\n| take 100",
              "size": 0,
              "title": "Recent Extension Activity",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table"
            },
            "name": "ext_table",
            "customWidth": "100"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "SelectedTab",
        "comparison": "isEqualTo",
        "value": "extoverview"
      },
      "name": "group-extoverview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimProcessEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where '{PolicyGroup}' == 'All' or RuleName == '{PolicyGroup}'\n| where '{ExecutionType}' == 'All' or EventOriginalType == '{ExecutionType}'\n| extend EventTypeName = case(\n    EventOriginalType == '0', 'Trusted Execution',\n    EventOriginalType == '1', 'Blocked Execution',\n    EventOriginalType == '2', 'Untrusted Execution [Audit]',\n    EventOriginalType == '3', 'Untrusted Execution [OTP]',\n    EventOriginalType == '4', 'Trusted Path Execution',\n    EventOriginalType == '5', 'Trusted Publisher Execution',\n    EventOriginalType == '6', 'Blocklist Execution',\n    EventOriginalType == '7', 'Blocklist Execution [Audit]',\n    EventOriginalType == '8', 'Trusted Process Execution',\n    EventOriginalType == '9', 'Constrained Execution',\n    EventOriginalType == '10', 'Trusted Metadata Execution',\n    EventOriginalType == '11', 'Trusted Browser Execution',\n    EventOriginalType == '12', 'Blocked Browser Execution',\n    EventOriginalType == '13', 'Untrusted Browser Execution [Audit]',\n    EventOriginalType == '14', 'Untrusted Browser Execution [OTP]',\n    EventOriginalType == '15', 'Blocklist Browser Execution [Audit]',\n    EventOriginalType == '16', 'Blocklist Browser Execution',\n    EventOriginalType == '17', 'Trusted Installer Execution',\n    EventOriginalType == '18', 'Trusted Browser Metadata Execution',\n    isnotempty(EventOriginalType), EventOriginalType,\n    strcat('Unknown (', EventOriginalType, ')'))\n| project TimeGenerated, DvcHostname, ActorUsername, TargetProcessName, ['Execution Type'] = EventTypeName, TargetProcessFileCompany, RuleName, TargetProcessSHA256\n| order by TimeGenerated desc\n| take 1000",
              "size": 3,
              "title": "Execution History \u2014 All Executions",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "filter": true
              }
            },
            "name": "rt_table",
            "customWidth": "100"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "SelectedTab",
        "comparison": "isEqualTo",
        "value": "realtime"
      },
      "name": "group-realtime"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimAuditEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| where isnotempty(Operation)\n| summarize Count = count() by Operation\n| order by Count desc",
              "size": 0,
              "title": "Activity by Task Type",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "sa_by_task",
            "customWidth": "33"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "ASimAuditEventAirlockDigital\n| where TimeGenerated >= {TimeSelector}\n| project ['Date / Time'] = TimeGenerated, ['Server Task'] = Operation, User = ActorUsername, Description = EventMessage\n| order by ['Date / Time'] desc\n| take 200",
              "size": 0,
              "title": "Server Activity History",
              "timeContext": {
                "durationMs": 315360000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table"
            },
            "name": "sa_table",
            "customWidth": "67"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "SelectedTab",
        "comparison": "isEqualTo",
        "value": "svractivity"
      },
      "name": "group-svractivity"
    }
  ],
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}