{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "### Threats by Platform (last 30 days)"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ZimperiumThreatLogV2_CL \n| where TimeGenerated >= ago(30d) and device_os != \"\" and tolower(device_os) != \"\"\n| summarize Count=count() by Platform = tolower(device_os)",
        "size": 0,
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Platform",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "ios",
              "color": "orange"
            },
            {
              "seriesName": "android",
              "color": "blue"
            }
          ]
        }
      },
      "name": "Threats by Platform"
    },
    {
      "type": 1,
      "content": {
        "json": "### Threats by Attack Vector (last 30 days)"
      },
      "name": "text - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ZimperiumThreatLogV2_CL | project threat_vector, TimeGenerated\n| where TimeGenerated >= ago(30d) and tolower(threat_vector) != \"\"\n| summarize Count=count() by  tolower(threat_vector)",
        "size": 0,
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "malware",
              "label": "Apps",
              "color": "magenta"
            },
            {
              "seriesName": "network",
              "label": "Network",
              "color": "yellow"
            },
            {
              "seriesName": "device",
              "label": "Device",
              "color": "green"
            }
          ]
        }
      },
      "name": "Threats by Attack Vector"
    },
    {
      "type": 1,
      "content": {
        "json": "### Top 10 Threat Types (last 30 days)"
      },
      "name": "text - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ZimperiumThreatLogV2_CL \n| where TimeGenerated >= ago(30d)\n| summarize threat_count = count() by threat_name\n| sort by threat_count desc\n| limit 10",
        "size": 0,
        "aggregation": 2,
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "threat_count",
              "formatter": 0,
              "formatOptions": {
                "showIcon": true,
                "aggregation": "Count"
              }
            }
          ]
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "threat_name",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "threat_count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "Top 10 Threats"
    }
  ],
  "fromTemplateId": "sentinel-ZimperiumMTDCCFWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}