{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Using SenservaPro Across Multiple Log Analytics Workspaces\n---\n\nThis workbook helps serve as a guide for users who are using SenservaPro across multiple instances of SenservaPro. These users generally have multiple tenants or a geographical data location requirement. \nMore information can be found at https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants\n\n\nSelect one workspace as the main conduit to create a unified view. Create a Sentinel Function to provide an easy alias for your queries.\nMore information about Sentinel Functions can be found at https://docs.microsoft.com/azure/azure-monitor/logs/functions"
      },
      "name": "text - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "As an example, create a Sentinel function to get from a Workspace called 'LogAnalyticsSenservaTest'\r\n\r\n>union \r\n>(workspace(\"LogAnalyticsSenservaTest\").SenservaPro_CL), (SenservaPro_CL)\r\n\r\nSave this with an alias of 'SenservaProUnionQuery'. Query all your workspaces with the alias instead 'SenservaPro_CL'\r\n\r\n>SenservaProUnionQuery"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union \r\n(workspace(\"LogAnalyticsSenservaTest\").SenservaPro_CL), (SenservaPro_CL)\r\n| where ControlName_s != ''\r\n| order by TimeGenerated\r\n| top 3 by TimeGenerated\r\n| project ControlName_s, JSONData=parse_json(Value_s)",
        "size": 0,
        "title": "Example using Workspace Union Query",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 3",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaProUnionQuery\n| where ControlName_s != ''\n| order by TimeGenerated\n| top 3 by TimeGenerated\n| project ControlName_s, JSONData=parse_json(Value_s)",
        "size": 1,
        "title": "Example using Sentinel Function",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 2",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "SenservaPro provides the Log Analytics Workspace Name as part of the output data. The Sentinel Function alias won't prevent you from knowing the Workspace source of the data."
      },
      "name": "text - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union \r\n(workspace(\"LogAnalyticsSenservaTest\").SenservaPro_CL), (SenservaPro_CL)\r\n| where Group_s == 'Users'\r\n| extend ControlNameSource = strcat(LogAnalyticsWorkspaceDisplayName_s, '.', ControlName_s)\r\n| summarize count() by ControlNameSource\r\n| top 10 by ControlNameSource\r\n| render piechart \r\n",
        "size": 0,
        "title": "Example Workspace Union Query - Top User Controls Count (Name.Workspace)",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 5",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaProUnionQuery\r\n| where Group_s == 'Users'\r\n| extend ControlNameSource = strcat(LogAnalyticsWorkspaceDisplayName_s, '.', ControlName_s)\r\n| summarize count() by ControlNameSource\r\n| top 10 by ControlNameSource\r\n| render piechart",
        "size": 0,
        "title": "Example Sentinel Function - Top User Controls Count (Name.Workspace)",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 6",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let min_t = toscalar(ago(12h));\r\nlet max_t = toscalar(now());\r\nunion \r\n(workspace(\"LogAnalyticsSenservaTest\").SenservaPro_CL), (SenservaPro_CL)\r\n| where CEFLoggingLevel_d == 3\r\n| extend ControlNameSource = strcat(ControlName_s, '.', LogAnalyticsWorkspaceDisplayName_s)\r\n| make-series num=count() default=0 on TimeGenerated in range(min_t, max_t, 15m) by ControlNameSource\r\n| render timechart ",
        "size": 0,
        "title": "Example Workspace Union Query - High Severity Controls Count Over 12 Hours (Name.Workspace)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let min_t = toscalar(ago(12h));\r\nlet max_t = toscalar(now());\r\nSenservaProUnionQuery\r\n| where CEFLoggingLevel_d == 3\r\n| extend ControlNameSource = strcat(ControlName_s, '.', LogAnalyticsWorkspaceDisplayName_s)\r\n| make-series num=count() default=0 on TimeGenerated in range(min_t, max_t, 15m) by ControlNameSource\r\n| render timechart ",
        "size": 0,
        "title": "Example Sentinel Function - High Severity Controls Count Over 12 Hours (Name.Workspace)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 8"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-SenservaProMultipleWorkspaceWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}