{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Zscaler EMAIL DLP overview"
      },
      "name": "text - 0"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSEmaildlplog\"\n| where DeviceEventClassID == \"DLP Incident\"\n| summarize Incidents = count() \n    by bin(TimeGenerated, 1h), RuleLabel = coalesce(DeviceCustomString4, \"Unknown rule\")  // DeviceCustomString4Label == \"rulelabels\"\n| order by TimeGenerated asc",
        "size": 1,
        "title": "DLP incidents over time by DLP rule (trend chart)",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart",
        "chartSettings": {
          "xAxis": "TimeGenerated",
          "yAxis": [
            "Incidents"
          ]
        }
      },
      "name": "query - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSEmaildlplog\"\n| where DeviceEventClassID == \"DLP Incident\"\n| summarize TotalIncidents = count() by SourceUserName\n| top 10 by TotalIncidents;",
        "size": 0,
        "title": "Top senders generating DLP incidents",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Zscaler\"\n| where DeviceProduct == \"NSSEmaildlplog\"\n| where DeviceEventClassID == \"DLP Incident\"\n| extend FileType = extract(@\"ac_filetypes=([^;]+)\", 1, AdditionalExtensions)\n| extend FileType = iff(isempty(FileType), \"Unknown\", FileType)\n| extend DlpDictionary = coalesce(DeviceCustomString1, \"Unknown dictionary\")\n| summarize Incidents = count() by DlpDictionary, FileType\n| order by Incidents desc",
        "size": 0,
        "title": "DLP incidents by dictionary/policy and attachment file type",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 3"
    }
  ],
  "fromTemplateId": "sentinel-UserWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}