{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Zscaler Tunnel Overview"
      },
      "name": "text - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSTunnellog\"\n| where DeviceEventClassID == \"Tunnel Samples\"\n| summarize ReceivedBytesSum=sum(ReceivedBytes), SentBytesSum=sum(SentBytes) by bin(TimeGenerated, 30m)\n| order by TimeGenerated asc",
        "size": 0,
        "title": "The bytes received and transmitted in a 60-second sample window by Zscaler from the customer",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSTunnellog\"\n| where DeviceEventClassID == \"Tunnel Samples\"\n| where DeviceCustomString4 !=\"\"\n| distinct DeviceCustomString4 \n| distinct DeviceCustomString4\n| project-rename LocationName = DeviceCustomString4\n| order by LocationName asc // Optional: Orders the distinct names alphabetically",
        "size": 0,
        "title": "List of locations",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSTunnellog\"\n| where DeviceEventClassID == \"Tunnel Event\"\n| summarize Count = count() by Activity, Reason\n| order by Count desc",
        "size": 0,
        "title": "Tunnel status events",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "name": "query - 2"
    }
  ],
  "fromTemplateId": "sentinel-UserWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}