{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "### Delinea Workbook\n"
      },
      "name": "text - 2",
      "styleSettings": {
        "margin": "1",
        "padding": "1"
      }
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "d273a798-8340-441a-9289-d1a79c87ed0c",
            "version": "KqlParameterItem/1.0",
            "name": "Timespan",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 43200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 1,
      "content": {
        "json": "Most usage operations for SecretServer"
      },
      "name": "text - 9"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Overview",
            "subTarget": "FileType != \"test event\"",
            "style": "primary"
          },
          {
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Secret",
            "subTarget": "FileType == \"Secret\"",
            "style": "primary"
          },
          {
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "User",
            "subTarget": "FileType == \"User\"",
            "style": "primary"
          },
          {
            "cellValue": "page",
            "linkTarget": "parameter",
            "linkLabel": "Folder",
            "subTarget": "FileType == \"Folder\"",
            "style": "secondary"
          }
        ]
      },
      "name": "links - 3",
      "styleSettings": {
        "margin": "0px",
        "padding": "0px"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\" | where DeviceProduct == \"Secret Server\" | where LogSeverity == 2 \n| where {page:query}\n| where TimeGenerated {Timespan:query}\n| summarize countRecord = count(), lastDate = arg_max(TimeGenerated, *) by FileName\n| order by countRecord\n| take 10\n| project FileType, Activity, SecretName=FileName, countRecord, lastDate ",
        "size": 2,
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "FileType",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "countRecord",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "FileType",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "countRecord",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "nodeIdField": "countRecord",
          "sourceIdField": "Activity",
          "targetIdField": "FileType",
          "graphOrientation": 3,
          "showOrientationToggles": false,
          "nodeSize": null,
          "staticNodeSize": 100,
          "colorSettings": null,
          "hivesMargin": 5
        }
      },
      "name": "query - 3"
    },
    {
      "type": 1,
      "content": {
        "json": "## Expiring Secrets"
      },
      "name": "text - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\" \r\n| where DeviceProduct == \"Secret Server\" \r\n| where LogSeverity == 2 \r\n| where TimeGenerated > ago(1d)\r\n| summarize count() by Activity\r\n| where extract(\"EXPIRE[S|D](\\\\d+)DAY\\\\w?\", 1, Activity) != \"\"\r\n| project extract(\"EXPIRE[S|D](\\\\d+)DAY\\\\w?\", 1, Activity), count_\r\n| order by count_ asc ",
        "size": 0,
        "noDataMessage": "Secrets that will soon expire are not found",
        "noDataMessageStyle": 3,
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "03",
              "label": "Expiring in 3 days",
              "comment": "Expire to 3 days"
            },
            {
              "seriesName": "07",
              "label": "Expiring in 7 days",
              "comment": "Expire to 7 days"
            },
            {
              "seriesName": "15",
              "label": "Expiring in 15 days",
              "comment": "Expire to 15 days"
            },
            {
              "seriesName": "30",
              "label": "Expiring in 30 days"
            },
            {
              "seriesName": "01",
              "label": "Expiring in 1 day"
            }
          ],
          "ySettings": {
            "numberFormatSettings": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "useGrouping": true
              }
            }
          }
        }
      },
      "name": "query - 4"
    },
    {
      "type": 1,
      "content": {
        "json": "### Expiring Today"
      },
      "name": "text - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where LogSeverity == 2 \r\n| where TimeGenerated > ago(1d)\r\n| summarize count() by Activity\r\n| where Activity == \"SECRET - EXPIREDTODAY\"\r\n| project count_\r\n| order by count_ asc ",
        "size": 0,
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "FileName",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Delinea Software\" or DeviceVendor == \"Thycotic Software\"\n| where DeviceProduct == \"Secret Server\"\n| where LogSeverity == 2 \r\n| where TimeGenerated > ago(1d)\r\n| summarize count() by Activity, FileName\r\n| where Activity == \"SECRET - EXPIREDTODAY\"\r\n| project FileName",
        "size": 0,
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "FileName",
              "formatter": 1,
              "formatOptions": {
                "customColumnWidthSetting": "150px"
              }
            }
          ],
          "labelSettings": [
            {
              "columnId": "FileName",
              "label": "Secret Name"
            }
          ]
        }
      },
      "name": "query - 8"
    }
  ],
  "fallbackResourceIds": [
    ""
  ],
  "fromTemplateId": "sentinel-Delinea",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}