{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Additional diagrams about generic LastPass usage\r\n---"
      },
      "name": "text - 6"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "LastPassNativePoller_CL\r\n| where isnotempty(Data_s)\r\n| summarize count() by Data_s\r\n| order by count_\r\n| render piechart",
              "size": 3,
              "title": "Overview of the sites used",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "30",
            "name": "query - 7"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "LastPassNativePoller_CL\r\n| where Username_s != \"API\"\r\n| summarize count() by Username_s\r\n| order by count_\r\n| render piechart",
              "size": 3,
              "title": "Overview of the active users",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "30",
            "name": "query - 8"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "LastPassNativePoller_CL\r\n| where Action_s != \"Reporting\"\r\n| summarize count() by Action_s\r\n| order by count_\r\n| render piechart",
              "size": 3,
              "title": "Overview of the activity types",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "30",
            "name": "query - 2"
          }
        ]
      },
      "name": "Additional diagrams about generic LastPass usage"
    },
    {
      "type": 1,
      "content": {
        "json": "## Insights into sign-in methods\r\n---"
      },
      "name": "text - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let IPs = SigninLogs | project IPAddress;\r\nLastPassNativePoller_CL\r\n| where Action_s != \"Reporting\"\r\n| where IP_Address_s !in (IPs)\r\n| summarize Count = count() by bin(todatetime(Time_s), 1d)\r\n| render timechart",
        "size": 3,
        "title": "Sign-ins using an IP which has not been observed before",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart",
        "chartSettings": {
          "showMetrics": false,
          "ySettings": {
            "min": 0
          }
        }
      },
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LastPassNativePoller_CL\r\n| where Action_s == \"Log in\"\r\n| join (SigninLogs | where AppDisplayName == \"LastPass Enterprise\") on $left.IP_Address_s == $right.IPAddress\r\n| extend isCompliant = iff(DeviceDetail.isCompliant == \"true\", \"Compliant\", \"Non-Compliant\")\r\n| summarize count() by isCompliant",
        "size": 3,
        "title": "Overview of compliancy state of device used to login",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "query - 5"
    },
    {
      "type": 1,
      "content": {
        "json": "## Logins in to admin console"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LastPassNativePoller_CL\n| where Action_s == \"Login to Admin Console\"\n| summarize Count = count() by Username_s",
        "size": 3,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 2"
    }
  ],
  "fromTemplateId": "sentinel-LastPass",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}