{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "### Illumio Workloads Stats\n---\n\nThis workbook uses Illumio APIs to fetch workload details and presents stats."
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "a089608b-daae-4b06-91ff-94b81c03bea8",
            "version": "KqlParameterItem/1.0",
            "name": "Illumio_PCE",
            "label": "Illumio PCE",
            "type": 2,
            "isRequired": true,
            "query": "Illumio_Workloads_Summarized_API_CL\n| summarize by pce_fqdn",
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": "scp4.illum.io"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 5"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "tabStyle": "bigger",
        "links": [
          {
            "id": "4de2c193-277e-4f8e-88b5-2caac1676e2b",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Workload Operations",
            "subTarget": "0",
            "style": "link",
            "tabWidth": "500px"
          },
          {
            "id": "8b46c8dd-071a-4bd4-9d36-1247d8777702",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Workload Investigations",
            "subTarget": "1",
            "style": "link",
            "tabWidth": "500px"
          }
        ]
      },
      "name": "links - 9"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "print workload_response = '{GETWorkloadsAPI}'\n| project parse_json(workload_response)\n| mv-apply workload_response on (\n    where workload_response.managed == 'true' and isnotempty(workload_response.risk_summary)\n    | project exposure_severity = workload_response.risk_summary.ransomware.workload_exposure_severity,\n            protection_percentage = workload_response.risk_summary.ransomware.ransomware_protection_percent,\n            updated_at = workload_response.risk_summary.ransomware.last_updated_at\n    )",
              "size": 0,
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "sortBy": [
                  {
                    "itemKey": "protection_percentage",
                    "sortOrder": 2
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "protection_percentage",
                  "sortOrder": 2
                }
              ],
              "tileSettings": {
                "showBorder": false
              }
            },
            "name": "query - 0"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "2"
      },
      "name": "Ransomware"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_version)\n| mv-expand keyValue = parsedJson\n| extend version = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project version, count_",
              "size": 3,
              "title": "Workloads by VEN Version",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "showMetrics": false,
                "showLegend": true,
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 5",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_managed)\n| mv-expand keyValue = parsedJson\n| extend managed = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project managed = iff(managed == 'true', 'Managed', 'Unmanaged'), count_",
              "size": 3,
              "title": "Managed and Unmanaged workload counts",
              "noDataMessage": "No workloads",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "showMetrics": false,
                "showLegend": true,
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 4",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_type)\n| mv-expand keyValue = parsedJson\n| extend type = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project type, count_",
              "size": 3,
              "title": "VENs by type",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 3",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_os)\n| mv-expand keyValue = parsedJson\n| extend os = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project os, count_",
              "size": 3,
              "title": "Managed workloads by OS",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "showMetrics": false,
                "showLegend": true,
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 6",
            "styleSettings": {
              "maxWidth": "50"
            }
          }
        ],
        "exportParameters": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "0"
      },
      "name": "WorkloadOperations"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_enforcement_mode)\n| mv-expand keyValue = parsedJson\n| extend mode = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project mode = case(mode == 'full', 'Full',\n         mode == 'visibility_only', 'Visibility Only',\n         mode == 'selective', \"Selective\",\n        \"Idle\"), count_\n",
              "size": 3,
              "title": "Workloads by enforcement modes",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 7",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_status)\n| mv-expand keyValue = parsedJson\n| extend status = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project status, count_\n",
              "size": 3,
              "title": "VENs by Status",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 1",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Illumio_Workloads_Summarized_API_CL\n| where pce_fqdn == ('{Illumio_PCE}')\n| order by TimeGenerated desc\n| top 1 by TimeGenerated\n| extend parsedJson = parse_json(vens_by_sync_state)\n| mv-expand keyValue = parsedJson\n| extend sync_state = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\n| project sync_state, count_\n",
              "size": 3,
              "title": "VENs by synchronization state",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true,
                      "minimumIntegerDigits": 1
                    }
                  }
                }
              }
            },
            "name": "query - 2"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "1"
      },
      "name": "Workload Investigations"
    }
  ],
  "fromTemplateId": "sentinel-apiWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}