{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## NetClean Overview last 30 Days\nShows only original incident, please specify the incident you would like to view to include near by files\n"
            },
            "name": "text - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL | where value_incidentVersion_d == 1 |summarize Count=count() by key_type_s, value_agent_type_s",
              "size": 1,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "categoricalbar",
              "chartSettings": {
                "xAxis": "value_agent_type_s",
                "yAxis": [
                  "Count"
                ]
              }
            },
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL | where value_incidentVersion_d == 1 |summarize Count=count() by value_file_calculatedHashes_sha1_s",
              "size": 4,
              "title": "SHA1",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "SHA1",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL | where value_incidentVersion_d == 1 |summarize Count=count() by value_agent_type_s",
              "size": 4,
              "title": "Agent Type",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "Agent Type"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where value_incidentVersion_d == 1\n| extend machineName = coalesce(value_device_machineName_s, value_agent_type_s)\n| summarize Count = count() by machineName\n",
              "size": 4,
              "title": "Hostname",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "Hostname"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL | where value_incidentVersion_d == 1 | distinct key_identifier_g, TimeGenerated,  value_agent_type_s | sort by TimeGenerated desc | project-rename Incident_Identifier=key_identifier_g, TimeGenerated, Agent_Type=value_agent_type_s",
              "size": 0,
              "title": "List of incidents ",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "sortBy": "[]"
              },
              "sortBy": "[]"
            },
            "name": "List of incidents "
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL | where value_incidentVersion_d == 1 | sort by TimeGenerated asc\n| summarize Count=count() by format_datetime (TimeGenerated,'yy-MM-dd '), key_identifier_g\n",
              "size": 0,
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "Week",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "graphSettings": {
                "type": 0
              },
              "chartSettings": {
                "xAxis": "TimeGenerated",
                "yAxis": [
                  "Count"
                ],
                "xSettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": false
                    },
                    "missingSparkDataOption": "Zero"
                  }
                },
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true
                    }
                  }
                }
              },
              "mapSettings": {
                "locInfo": "LatLong",
                "sizeSettings": "count_",
                "sizeAggregation": "Sum",
                "legendMetric": "count_",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "count_",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "name": "query - 4"
          }
        ]
      },
      "name": "NetClean Oerview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## NetClean Incident"
            },
            "name": "text - 4"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "1e3b2c62-399e-43e6-a643-8a7484ac5c91",
                  "version": "KqlParameterItem/1.0",
                  "name": "incident",
                  "type": 2,
                  "query": "Netclean_Incidents_CL |where value_incidentVersion_d == 1 | sort by TimeGenerated desc | project key_identifier_g ",
                  "typeSettings": {
                    "additionalResourceOptions": [],
                    "showDefault": false
                  },
                  "timeContext": {
                    "durationMs": 2592000000
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": "7186627a-4a09-4276-a6ae-9687aa5d2e89"
                },
                {
                  "id": "a3554367-06f8-4027-8134-07af2b82675b",
                  "version": "KqlParameterItem/1.0",
                  "name": "agentType",
                  "type": 2,
                  "isRequired": true,
                  "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | distinct value_agent_type_s",
                  "typeSettings": {
                    "additionalResourceOptions": [
                      "value::1"
                    ],
                    "showDefault": false
                  },
                  "defaultValue": "value::1",
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | top 1 by TimeGenerated | project value_file_signature_hashes_sha1_s\n",
              "size": 4,
              "title": "SHA1",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "name": "SHA1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | top 1 by TimeGenerated | project value_file_path_s\n",
              "size": 4,
              "title": "File Path",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "card",
              "textSettings": {
                "style": "bignumber"
              }
            },
            "name": "File Path"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" |summarize Count=count()",
              "size": 4,
              "title": "Number of log entrys for specified incident",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "min": 1,
                    "palette": "purpleDark"
                  },
                  "tooltipFormat": {
                    "tooltip": "Number of log entrys for specified incident"
                  }
                },
                "showBorder": false
              }
            },
            "customWidth": "20",
            "name": "Number of log entrys for specified incident"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| extend NearbyFiles = parse_json(value_file_nearbyFiles_s)\n| project IsNotEmpty = iff(not(isempty(NearbyFiles)), \"true\", \"false\")\n",
              "size": 4,
              "title": "Has Collected Nearby Files",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "IsNotEmpty",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 0,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": false,
                "size": "auto"
              }
            },
            "customWidth": "20",
            "name": "hasCollectedNearbyFiles"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | top 1 by TimeGenerated | project value_file_owner_computerUser_domain_s\n            ",
              "size": 4,
              "title": "Domain",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "value_file_owner_computerUser_domain_s",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 0,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": false,
                "size": "auto"
              }
            },
            "customWidth": "20",
            "name": "domain"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| extend NearbyFiles = parse_json(value_file_nearbyFiles_s)\n| mv-expand NearbyFiles\n| extend Sha1 = tostring(NearbyFiles.calculatedHashes.sha1)\n| summarize NumberOfSha1s = count(Sha1)\n\n\n\n\n\n",
              "size": 4,
              "title": "Number of nearby files",
              "noDataMessage": "0",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "gridSettings": {
                "sortBy": "[]"
              },
              "sortBy": "[]",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "NumberOfSha1s",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    },
                    "emptyValCustomText": "0"
                  }
                },
                "showBorder": true,
                "size": "auto"
              }
            },
            "customWidth": "20",
            "name": "Number of nearby files"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| extend NearbyFiles = parse_json(value_file_nearbyFiles_s)\n| mv-expand NearbyFiles\n| where NearbyFiles.isMatch == true\n| extend Sha1 = tostring(NearbyFiles.calculatedHashes.sha1)\n| summarize NumberOfSha1s = count(Sha1)\n",
              "size": 4,
              "title": "Number of nearby files with match",
              "noDataMessage": "0",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "gridSettings": {
                "sortBy": "[]"
              },
              "sortBy": "[]",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "NumberOfSha1s",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "orange"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    },
                    "emptyValCustomText": "0"
                  }
                },
                "showBorder": true,
                "size": "auto"
              }
            },
            "customWidth": "20",
            "name": "Number of nearby files with match"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| project value_device_machineName_s, value_device_operatingSystemVersion_s, Interfaces = parse_json(value_device_networkInterfaces_s), value_file_diskDrive_diskType_s, value_file_diskDrive_volumeSerialNumber_s,value_file_diskDrive_mountPoint_s\n            \n| mv-expand Interfaces\n| extend Description = tostring(Interfaces.description), IPs = Interfaces.ipAddresses\n| mv-expand IPs\n| where IPs !in (\"::1\", \"127.0.0.1\")\n| where tostring(IPs) !startswith(\"fe80::\")  // Exclude link-local IPv6 addresses\n| project IPv4 = IPs, value_device_machineName_s, value_device_operatingSystemVersion_s, value_file_diskDrive_diskType_s, value_file_diskDrive_volumeSerialNumber_s, value_file_diskDrive_mountPoint_s\n            \n\n            \n            \n\n\n\n\n\n\n",
              "size": 4,
              "title": "Hostname",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "sortBy": [],
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Hostname_s",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 0,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": false,
                "sortCriteriaField": "hasCollectedNearbyFiles_s",
                "sortOrderField": 1,
                "size": "auto"
              },
              "textSettings": {
                "style": "header"
              }
            },
            "conditionalVisibility": {
              "parameterName": "agentType",
              "comparison": "isEqualTo",
              "value": "computer"
            },
            "name": "Hostname"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| extend LoggedOnUsers = parse_json(value_device_loggedOnUsers_s)\n| mv-expand LoggedOnUsers\n| extend Username = tostring(LoggedOnUsers.computerUser.username),\n         LogonTime = tostring(LoggedOnUsers.computerUser.logonTime),\n         LogonType = tostring(LoggedOnUsers.computerUser.logonType),\n         Domain = tostring(LoggedOnUsers.computerUser.domain)\n| project Username, LogonTime, LogonType, Domain\n",
              "size": 0,
              "title": "All Logged On Users",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "loggedOnUsers_s",
                  "formatter": 1
                },
                "showBorder": true,
                "size": "auto"
              }
            },
            "conditionalVisibility": {
              "parameterName": "agentType",
              "comparison": "isEqualTo",
              "value": "computer"
            },
            "name": "LoggedOnUsers"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL\n| where key_identifier_g == \"{incident}\"\n| top 1 by TimeGenerated\n| extend NearbyFiles = parse_json(value_file_nearbyFiles_s)\n| mv-expand NearbyFiles\n| project FileName = tostring(NearbyFiles.fileName), Sha1 = tostring(NearbyFiles.calculatedHashes.sha1)",
              "size": 4,
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "nearbyFiles"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | top 1 by TimeGenerated\n| project format_datetime (value_file_creationTime_t,'yyyy-MM-dd HH:mm:ss'), format_datetime (value_file_lastAccessTime_t,'yyyy-MM-dd HH:mm:ss'), format_datetime (value_file_lastModifiedTime_t ,'yyyy-MM-dd HH:mm:ss'), format_datetime (TimeGenerated,'yyyy-MM-dd HH:mm:ss'),  format_datetime (value_foundTime_t,'yyyy-MM-dd HH:mm:ss') ",
              "size": 4,
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "creationTime_t",
                  "numberFormat": {
                    "unit": 27,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "size": "auto"
              },
              "graphSettings": {
                "type": 0,
                "nodeIdField": "foundTime_t",
                "sourceIdField": "foundTime_t",
                "targetIdField": "foundTime_t",
                "graphOrientation": 3,
                "showOrientationToggles": false,
                "nodeSize": "",
                "staticNodeSize": 100,
                "colorSettings": "",
                "hivesMargin": 5
              },
              "mapSettings": {
                "locInfo": "LatLong"
              }
            },
            "name": "query - 3"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Netclean_Incidents_CL  | where key_identifier_g == \"{incident}\" | top 1 by TimeGenerated | project key_type_s, value_file_microsoft365_site_displayName_s, value_file_microsoft365_site_name_s, value_file_microsoft365_id_s, value_file_microsoft365_mimeType_s, value_file_microsoft365_webUrl_s, value_file_microsoft365_library_displayName_s, value_file_microsoft365_library_type_s\n\n\n\n\n\n\n",
              "size": 4,
              "title": "Cloud Agent ",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table"
            },
            "conditionalVisibility": {
              "parameterName": "agentType",
              "comparison": "isEqualTo",
              "value": "microsoft365"
            },
            "name": "Cloud Agent "
          }
        ]
      },
      "name": "group - 5"
    }
  ],
  "fromTemplateId": "sentinel-NetCleanProActiveWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}