{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "Version 1.0\r\n\r\nThis dashboard offers a detailed visual representation of alerts generated specifically for the Tier Model.\r\n\r\nFor optimal functionality, it is essential that all Domain Controllers forward EventLog Security events to Sentinel. Additionally, the Tier Model Analytical Rules and Automation Rules must be activated within Sentinel."
      },
      "name": "text - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "189936cd-f65e-4168-9a8b-e14bf4ad216c",
                  "version": "KqlParameterItem/1.0",
                  "name": "TimeRange",
                  "label": "Time Range",
                  "type": 4,
                  "isRequired": true,
                  "typeSettings": {
                    "selectableValues": [
                      {
                        "durationMs": 1800000
                      },
                      {
                        "durationMs": 3600000
                      },
                      {
                        "durationMs": 14400000
                      },
                      {
                        "durationMs": 43200000
                      },
                      {
                        "durationMs": 86400000
                      },
                      {
                        "durationMs": 172800000
                      },
                      {
                        "durationMs": 259200000
                      },
                      {
                        "durationMs": 604800000
                      },
                      {
                        "durationMs": 1209600000
                      },
                      {
                        "durationMs": 2419200000
                      },
                      {
                        "durationMs": 2592000000
                      },
                      {
                        "durationMs": 5184000000
                      },
                      {
                        "durationMs": 7776000000
                      }
                    ]
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "value": {
                    "durationMs": 7776000000
                  }
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 0"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": ""
                  },
                  "customWidth": "5",
                  "name": "text - 8"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Status == \"New\"\r\n     or Status == \"Active\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Status",
                    "size": 4,
                    "title": "# Incident New/Active",
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Status",
                        "formatter": 14,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal"
                          }
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "greenRed"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false,
                      "size": "auto"
                    }
                  },
                  "customWidth": "15",
                  "name": "# Incident New/Active",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity == \"High\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity",
                    "size": 4,
                    "title": "# High Incidents",
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Severity",
                        "formatter": 14,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal"
                          }
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "redGreen"
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "15",
                  "name": "# High Incidents",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity  == \"Medium\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity",
                    "size": 4,
                    "title": "# Medium Incidents",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Severity",
                        "formatter": 14,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal"
                          }
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "orangeBlue"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false,
                      "size": "auto"
                    }
                  },
                  "customWidth": "15",
                  "name": "# Medium Incidents",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity  == \"Low\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity",
                    "size": 4,
                    "title": "# Low Incidents",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Severity",
                        "formatter": 14,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal"
                          }
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "yellowGreenBlue"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "15",
                  "name": "# Low Incidents",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity  == \"Informational\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity",
                    "size": 4,
                    "title": "# Informational Incidents",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Severity",
                        "formatter": 13,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true,
                          "compositeBarSettings": {
                            "labelText": "",
                            "columnSettings": []
                          }
                        },
                        "numberFormat": {
                          "unit": 0,
                          "options": {
                            "style": "decimal"
                          }
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "whiteBlack"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "15",
                  "name": "query - 6",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Status == \"Closed\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Status",
                    "size": 4,
                    "title": "# Incidents Closed",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "tiles",
                    "tileSettings": {
                      "titleContent": {
                        "columnMatch": "Status",
                        "formatter": 14,
                        "formatOptions": {
                          "linkTarget": null,
                          "showIcon": true
                        }
                      },
                      "rightContent": {
                        "columnMatch": "CountByStatus",
                        "formatter": 12,
                        "formatOptions": {
                          "palette": "blueOrange"
                        },
                        "numberFormat": {
                          "unit": 17,
                          "options": {
                            "style": "decimal",
                            "maximumFractionDigits": 1
                          }
                        }
                      },
                      "showBorder": false
                    }
                  },
                  "customWidth": "15",
                  "name": "# Incidents Closed",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| summarize count() by bin(TimeGenerated, 1d), Severity\r\n| render timechart",
                    "size": 0,
                    "title": "Time of Incident by Severity {TimeRange:query}",
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces"
                  },
                  "customWidth": "75",
                  "name": "query - 7",
                  "styleSettings": {
                    "showBorder": true
                  }
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nlet High = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity == \"High\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity;\r\nlet Medium = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity == \"Medium\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity;\r\nlet Low = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity == \"Low\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity;\r\nlet Informational = SecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| where Severity == \"Informational\"\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| summarize CountByStatus = count() by Severity;\r\nunion High\r\n    , Medium\r\n    , Low\r\n    , Informational",
                    "size": 0,
                    "title": "Severity Comparison",
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "visualization": "piechart",
                    "chartSettings": {
                      "seriesLabelSettings": [
                        {
                          "seriesName": "High",
                          "label": "High",
                          "color": "redBright"
                        },
                        {
                          "seriesName": "Informational",
                          "label": "Informational",
                          "color": "gray"
                        },
                        {
                          "seriesName": "Low",
                          "label": "Low",
                          "color": "yellow"
                        },
                        {
                          "seriesName": "Medium",
                          "label": "Medium",
                          "color": "orange"
                        }
                      ]
                    }
                  },
                  "customWidth": "25",
                  "name": "query - 7",
                  "styleSettings": {
                    "showBorder": true
                  }
                }
              ]
            },
            "name": "Counts",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 9,
                  "content": {
                    "version": "KqlParameterItem/1.0",
                    "parameters": [
                      {
                        "id": "10dcd6c1-875c-4001-8508-f76d2dd18d55",
                        "version": "KqlParameterItem/1.0",
                        "name": "Status",
                        "type": 2,
                        "isRequired": true,
                        "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend AR_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| where AR_Name startswith \"PROD (TM\"\r\n| distinct AR_Name\r\n         , AR_ID;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend AR_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.AR_ID == $right.AR_ID\r\n| distinct Status",
                        "typeSettings": {
                          "additionalResourceOptions": [],
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 2592000000
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": null
                      },
                      {
                        "id": "2f12abb8-77e4-4cef-9888-dd7d5cf63f6b",
                        "version": "KqlParameterItem/1.0",
                        "name": "Severity",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Analytic_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| extend Domain = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).Domain))[0])\r\n| extend Object_Tier = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectTier))[0])\r\n| extend Object_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectType))[0])\r\n| extend Activity_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ActivityType))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| distinct Analytic_Name\r\n         , Analytic_ID\r\n         , Domain\r\n         , Object_Tier\r\n         , Object_Type\r\n         , Activity_Type;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.Analytic_ID == $right.Analytic_ID\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| distinct Severity\r\n",
                        "typeSettings": {
                          "additionalResourceOptions": [
                            "value::all"
                          ],
                          "selectAllValue": "*",
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 0
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": null
                      },
                      {
                        "id": "39f243ad-ce93-4e71-b84a-82fd57367ddd",
                        "version": "KqlParameterItem/1.0",
                        "name": "Domain",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Domain = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).Domain))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| distinct Label=Domain",
                        "typeSettings": {
                          "additionalResourceOptions": [
                            "value::all"
                          ],
                          "selectAllValue": "*",
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 0
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": null
                      },
                      {
                        "id": "6cdf1e45-9cf5-4ff6-be81-caf2302822e7",
                        "version": "KqlParameterItem/1.0",
                        "name": "Tier",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Domain = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).Domain))[0])\r\n| extend Object_Tier = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectTier))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| where Domain in ({Domain}) or '{Domain:label}' == \"All\"\r\n| distinct Label=Object_Tier",
                        "typeSettings": {
                          "additionalResourceOptions": [
                            "value::all"
                          ],
                          "selectAllValue": "*",
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 0
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": null
                      },
                      {
                        "id": "8fd6cadc-5dd1-4966-be87-d61fe1e998da",
                        "version": "KqlParameterItem/1.0",
                        "name": "Object_Class",
                        "label": "Object Class",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Object_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectType))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| distinct Object_Type",
                        "typeSettings": {
                          "additionalResourceOptions": [
                            "value::all"
                          ],
                          "selectAllValue": "*",
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 0
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": [
                          "value::all"
                        ]
                      },
                      {
                        "id": "3659c6d9-fd27-493d-9ae4-5056b352ef79",
                        "version": "KqlParameterItem/1.0",
                        "name": "Activity_Type",
                        "label": "Activity Type",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Activity_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ActivityType))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| distinct Activity_Type",
                        "typeSettings": {
                          "additionalResourceOptions": [
                            "value::all"
                          ],
                          "selectAllValue": "*",
                          "showDefault": false
                        },
                        "timeContext": {
                          "durationMs": 0
                        },
                        "timeContextFromParameter": "TimeRange",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces",
                        "value": [
                          "value::all"
                        ]
                      }
                    ],
                    "style": "pills",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces"
                  },
                  "name": "parameters - 1"
                },
                {
                  "type": 3,
                  "content": {
                    "version": "KqlItem/1.0",
                    "query": "let AR = SecurityAlert\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_Name = tostring(parse_json(ExtendedProperties).[\"Analytic Rule Name\"])\r\n| extend Analytic_ID = tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Analytic Rule Ids\"]))[0])\r\n| extend Domain = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).Domain))[0])\r\n| extend Object_Tier = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectTier))[0])\r\n| extend Object_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ObjectType))[0])\r\n| extend Activity_Type = tostring(parse_json(tostring(parse_json(tostring(parse_json(ExtendedProperties).[\"Custom Details\"])).ActivityType))[0])\r\n| where Analytic_Name startswith \"PROD (TM\"\r\n| distinct Analytic_Name\r\n         , Analytic_ID\r\n         , Domain\r\n         , Object_Tier\r\n         , Object_Type\r\n         , Activity_Type;\r\nSecurityIncident\r\n| where TimeGenerated {TimeRange:query}\r\n| extend Analytic_ID = tostring(RelatedAnalyticRuleIds[0])\r\n| join kind=inner AR on $left.Analytic_ID == $right.Analytic_ID\r\n| summarize LatestRecord = arg_max(TimeGenerated, *) by IncidentNumber\r\n| where Status startswith \"{Status:query}\"\r\n| where Severity in ({Severity}) or '{Severity:label}' == \"All\"\r\n| where Domain in ({Domain}) or '{Domain:label}' == \"All\"\r\n| where Object_Tier in ({Tier}) or '{Tier:label}' == \"All\"\r\n| where Object_Type in ({Object_Class}) or '{Object_Class:label}' == \"All\"\r\n| where Activity_Type in ({Activity_Type}) or '{Activity_Type:label}' == \"All\"\r\n| project LatestRecord\r\n        , Title\r\n        , IncidentNumber\r\n        , Status\r\n        , Severity\r\n        , Domain\r\n        , Object_Tier\r\n        , Object_Type\r\n        , Activity_Type\r\n        , FirstActivityTime\r\n        , LastActivityTime\r\n        , IncidentUrl\r\n        , Analytic_Name\r\n        , Analytic_ID\r\n| take 250",
                    "size": 0,
                    "timeContextFromParameter": "TimeRange",
                    "queryType": 0,
                    "resourceType": "microsoft.operationalinsights/workspaces",
                    "gridSettings": {
                      "sortBy": [
                        {
                          "itemKey": "Activity_Type",
                          "sortOrder": 2
                        }
                      ]
                    },
                    "sortBy": [
                      {
                        "itemKey": "Activity_Type",
                        "sortOrder": 2
                      }
                    ]
                  },
                  "name": "query - 0"
                }
              ]
            },
            "name": "Raw",
            "styleSettings": {
              "showBorder": true
            }
          }
        ]
      },
      "name": "Individual Incidents",
      "styleSettings": {
        "showBorder": true
      }
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-MicrosoftADTierModel",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}