{
    "version": "Notebook/1.0",
    "items": [
        {
            "type": 9,
            "content": {
                "version": "KqlParameterItem/1.0",
                "parameters": [
                    {
                        "id": "87db674f-0507-4481-a57b-0bf202e968b2",
                        "version": "KqlParameterItem/1.0",
                        "name": "bhe_tenant",
                        "label": "BHE Tenant",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHETierZeroAssetsData_CL  \n| where isnotempty(tenant_url)\n| summarize arg_max(TimeGenerated, *) by tenant_url\n| extend display_name = replace_string(tenant_url, @\"https://\", \"\")\n| extend display_name = replace_string(display_name, @\"http://\", \"\")\n| extend display_name = replace_string(display_name, @\"/\", \"\") \n| project tenant_url, display_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "selectAllValue": "",
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "a4cadb58-5551-4279-9a60-3b4e46b3ddf9",
                        "version": "KqlParameterItem/1.0",
                        "name": "domain_name",
                        "label": "Environment",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHETierZeroAssetsData_CL  \n| where isnotempty(domain_name)\n| where tenant_url in~ ({bhe_tenant})\n| distinct domain_name",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    },
                    {
                        "id": "98c37fb8-534d-4661-b8cf-2ce60a74b67a",
                        "version": "KqlParameterItem/1.0",
                        "name": "kind_type",
                        "label": "Type",
                        "type": 2,
                        "isRequired": true,
                        "multiSelect": true,
                        "quote": "'",
                        "delimiter": ",",
                        "query": "BHETierZeroAssetsData_CL \n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where isnotempty(kindType)\n| distinct kindType",
                        "typeSettings": {
                            "additionalResourceOptions": [
                                "value::all"
                            ],
                            "showDefault": false
                        },
                        "timeContext": {
                            "durationMs": 2592000000
                        },
                        "defaultValue": "value::all",
                        "queryType": 0,
                        "resourceType": "microsoft.operationalinsights/workspaces"
                    }
                ],
                "style": "pills",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "BHETierZeroAssetsData_CL\n| where tenant_url in~ ({bhe_tenant})\n| where domain_name in~ ({domain_name})\n| where kindType in~ ({kind_type})\n| summarize arg_max(TimeGenerated, *) by objectId, owner_objectid\n| project Name = name,\n          Environment = domain_name,\n          Type = kindType,\n          [\"Object Id\"] = objectId",
                "size": 0,
                "title": "Tier Zero Asset List",
                "timeContext": {
                    "durationMs": 604800000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "gridSettings": {
                    "rowLimit": 10000,
                    "filter": true
                }
            },
            "name": "query - 2"
        },
        {
            "type": 3,
            "content": {
                "version": "KqlItem/1.0",
                "query": "\nBHETierZeroAssetsData_CL\n| where tenant_url in~ ({bhe_tenant}) \n| where domain_name in~ ({domain_name})\n| where kindType in~ ({kind_type})\n| where isnotempty(objectId)\n| extend domain_name = toupper(domain_name)\n| summarize arg_max(TimeGenerated, *) by objectId   // dedup objectid, keep latest\n| summarize Count = count() by kindType, domain_name, tenant_url\n| project [\"kind\"] = kindType, domain_name, Count, tenant_url\n| order by Count desc\n\n",
                "size": 0,
                "title": "Tier Zero Asset Distribution",
                "timeContext": {
                    "durationMs": 604800000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "barchart",
                "tileSettings": {
                    "showBorder": false,
                    "titleContent": {
                        "columnMatch": "kind",
                        "formatter": 1
                    },
                    "leftContent": {
                        "columnMatch": "Count",
                        "formatter": 12,
                        "formatOptions": {
                            "palette": "auto"
                        },
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "maximumSignificantDigits": 3,
                                "maximumFractionDigits": 2
                            }
                        }
                    }
                },
                "graphSettings": {
                    "type": 0,
                    "topContent": {
                        "columnMatch": "kind",
                        "formatter": 1
                    },
                    "centerContent": {
                        "columnMatch": "Count",
                        "formatter": 1,
                        "numberFormat": {
                            "unit": 17,
                            "options": {
                                "maximumSignificantDigits": 3,
                                "maximumFractionDigits": 2
                            }
                        }
                    },
                    "rightContent": {
                        "columnMatch": "domain_name"
                    },
                    "bottomContent": {
                        "columnMatch": "tenant_url"
                    },
                    "nodeIdField": "kind",
                    "sourceIdField": "domain_name",
                    "targetIdField": "Count",
                    "graphOrientation": 3,
                    "showOrientationToggles": false,
                    "staticNodeSize": 100,
                    "hivesMargin": 5
                },
                "chartSettings": {
                    "xAxis": "domain_name",
                    "group": "kind",
                    "showLegend": true,
                    "xSettings": {
                        "label": "Kind Type"
                    },
                    "ySettings": {
                        "label": "Count"
                    }
                },
                "mapSettings": {
                    "locInfo": "LatLong",
                    "sizeSettings": "Count",
                    "sizeAggregation": "Sum",
                    "legendMetric": "Count",
                    "legendAggregation": "Sum",
                    "itemColorSettings": {
                        "type": "heatmap",
                        "colorAggregation": "Sum",
                        "nodeColorField": "Count",
                        "heatmapPalette": "greenRed"
                    }
                }
            },
            "name": "query - 4"
        }
    ],
    "fallbackResourceIds": [],
    "fromTemplateId": "sentinel-BloodHoundEnterprise",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}