{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Zscaler CASB Email Overview"
      },
      "name": "text - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSCasbemaillog\"\n| summarize EventCount = count() by DeviceEventClassID\n| render columnchart",
        "size": 0,
        "title": "Count of CASB Email Events by Application",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSCasbemaillog\"\n| extend EventTimestamp = todatetime(TimeGenerated)\n| summarize EventCount = count() by bin(EventTimestamp, 1h)\n| render timechart",
        "size": 0,
        "title": "CASB Email Events Over Time",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSCasbemaillog\"\n| extend KeyValuePairs = split(AdditionalExtensions, \";\")\n| mv-expand KeyValuePairs to typeof(string)\n| where KeyValuePairs contains \"owner=\"\n| extend OwnerValue = tostring(split(KeyValuePairs, \"=\")[1])\n| project EventTimestamp = todatetime(TimeGenerated), User = OwnerValue, Action = DeviceAction, Identifier = DeviceCustomString1\n| sort by EventTimestamp desc \n| render table",
        "size": 0,
        "title": "CASB Email Detailed Security Event Information",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 2"
    }
  ],
  "fromTemplateId": "sentinel-UserWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}