{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Lookout IOA Detection and Investigation Dashboard\n\n**Mobile device security monitoring and audit trail analysis**"
      },
      "name": "text - main title"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "TimeRange",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {"durationMs": 86400000},
                {"durationMs": 259200000},
                {"durationMs": 604800000},
                {"durationMs": 2592000000}
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - filters"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n## 📊 Event Summary"
      },
      "name": "text - summary header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by log_type\n| render piechart",
        "size": 0,
        "title": "Events by Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "events-by-type"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend Platform = tostring(device.platform)\n| summarize Count = count() by Platform",
        "size": 0,
        "title": "Devices by Platform",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "33",
      "name": "devices-by-platform"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend AuditType = tostring(audit.type)\n| summarize Count = count() by AuditType",
        "size": 0,
        "title": "Audit Events by Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "columnchart"
      },
      "customWidth": "34",
      "name": "audit-by-type"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by bin(TimeGenerated, 1h), log_type\n| render timechart",
        "size": 0,
        "title": "Event Timeline",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "event-timeline"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n## 📱 Device Inventory"
      },
      "name": "text - device header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend \n    DeviceGuid = tostring(device.guid),\n    Platform = tostring(device.platform),\n    ProfileType = tostring(device.profile_type),\n    Email = tostring(device.info.email),\n    Manufacturer = tostring(device.hardware.manufacturer),\n    Model = tostring(device.hardware.model),\n    OSVersion = tostring(device.software.os_version),\n    ActivationStatus = tostring(device.status.activation_status)\n| summarize \n    LastSeen = max(TimeGenerated),\n    arg_max(TimeGenerated, *)\n    by DeviceGuid\n| project \n    Email,\n    Platform,\n    Manufacturer,\n    Model,\n    OSVersion,\n    ActivationStatus,\n    ProfileType,\n    LastSeen\n| order by LastSeen desc",
        "size": 0,
        "title": "Device Inventory",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ActivationStatus",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {"operator": "==", "thresholdValue": "ACTIVE", "representation": "green", "text": "{0}"},
                  {"operator": "==", "thresholdValue": "PENDING", "representation": "yellow", "text": "{0}"},
                  {"operator": "Default", "representation": "gray", "text": "{0}"}
                ]
              }
            }
          ]
        }
      },
      "name": "device-inventory"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend \n    ActivationStatus = tostring(device.status.activation_status)\n| summarize Count = count() by ActivationStatus",
        "size": 0,
        "title": "Device Activation Status",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "device-activation-status"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"DEVICE\"\n| extend \n    OSVersion = tostring(device.software.os_version),\n    Platform = tostring(device.platform)\n| summarize Count = count() by Platform, OSVersion\n| order by Count desc",
        "size": 0,
        "title": "OS Version Distribution",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "os-distribution"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n## 🔍 Audit Trail"
      },
      "name": "text - audit header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend \n    AuditType = tostring(audit.type),\n    ActorType = tostring(actor.type),\n    ActorGuid = tostring(actor.guid),\n    TargetType = tostring(target.type),\n    TargetGuid = tostring(target.guid),\n    AttributeChanges = tostring(audit.attribute_changes)\n| project \n    TimeGenerated,\n    AuditType,\n    ActorType,\n    TargetType,\n    AttributeChanges\n| order by TimeGenerated desc",
        "size": 0,
        "title": "Recent Audit Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "AuditType",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {"operator": "contains", "thresholdValue": "LOGIN", "representation": "blue", "text": "{0}"},
                  {"operator": "contains", "thresholdValue": "CHANGE", "representation": "orange", "text": "{0}"},
                  {"operator": "Default", "representation": "gray", "text": "{0}"}
                ]
              }
            }
          ]
        }
      },
      "name": "audit-events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend \n    AuditType = tostring(audit.type),\n    ActorType = tostring(actor.type)\n| summarize Count = count() by ActorType",
        "size": 0,
        "title": "Audit Events by Actor Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "audit-by-actor"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| where log_type == \"AUDIT\"\n| extend \n    AuditType = tostring(audit.type)\n| where AuditType == \"ADMIN_LOGIN\"\n| extend \n    SourceIP = tostring(parse_json(tostring(audit.attribute_changes))[1].to)\n| summarize LoginCount = count() by SourceIP\n| order by LoginCount desc",
        "size": 0,
        "title": "Admin Logins by Source IP",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "customWidth": "50",
      "name": "admin-logins-by-ip"
    },
    {
      "type": 1,
      "content": {
        "json": "---\n## 📋 All Events"
      },
      "name": "text - all events header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "LookoutMtdV2_CL\n| where TimeGenerated {TimeRange}\n| extend \n    EventType = log_type,\n    Details = case(\n        log_type == \"DEVICE\", strcat(tostring(device.hardware.manufacturer), \" \", tostring(device.hardware.model), \" - \", tostring(device.info.email)),\n        log_type == \"AUDIT\", tostring(audit.type),\n        log_type == \"THREAT\", tostring(threat.type),\n        log_type == \"SMISHING_ALERT\", tostring(smishing_alert.type),\n        \"Unknown\"\n    )\n| project \n    TimeGenerated,\n    EventType,\n    Details,\n    enterprise_guid\n| order by TimeGenerated desc\n| take 100",
        "size": 0,
        "title": "All Recent Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "all-events"
    }
  ],
  "styleSettings": {},
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}