{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "apifirewall_log_1_CL\r\n| summarize request = count() by Source_IP_s\r\n| render piechart ",
        "size": 0,
        "title": "Requests by IP Address",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "mapSettings": {
          "locInfo": "CountryRegion",
          "locInfoColumn": "Source_IP_s",
          "sizeAggregation": "Sum",
          "legendAggregation": "Sum",
          "itemColorSettings": null
        }
      },
      "customWidth": "33",
      "name": "query - 3"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "apifirewall_log_1_CL\r\n| summarize request = count() by tostring(Status_d)\r\n| render piechart ",
        "size": 0,
        "title": "Status Code Return",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "33",
      "name": "query - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "apifirewall_log_1_CL\r\n| summarize request = count() by Instance_Name_s\r\n| render piechart ",
        "size": 0,
        "title": "Hits by Instances",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "33",
      "name": "query - 5 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "apifirewall_log_1_CL\r\n| make-series requests = count() default = 0 on Timestamp_t from  ago(1h) to now() step 5m by Instance_Name_s\r\n| render areachart ",
        "size": 0,
        "title": "Request over Time",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "apifirewall_log_1_CL\n| summarize Requests = count() , FailedRequests = countif(Status_d != 200) , SuccesfullRequests = countif(Status_d  == 200), LastEventTime  = max(TimeGenerated) by InstanceName = Instance_Name_s\n| extend Status = iff(LastEventTime >= ago(2h), \"Available\", \"Unavailable\")\n| project Status,InstanceName, Requests, SuccesfullRequests, FailedRequests, LastEventTime",
        "size": 1,
        "title": "Protection Instances",
        "exportFieldName": "InstanceName",
        "exportParameterName": "InstanceName",
        "exportDefaultValue": "",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Status",
              "formatter": 11
            },
            {
              "columnMatch": "Requests",
              "formatter": 4,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "SuccesfullRequests",
              "formatter": 4,
              "formatOptions": {
                "palette": "greenDarkDark"
              }
            },
            {
              "columnMatch": "FailedRequests",
              "formatter": 4,
              "formatOptions": {
                "palette": "redDark"
              }
            }
          ]
        }
      },
      "name": "Protection Instances"
    },
    {
      "type": 1,
      "content": {
        "json": "## Instance Information\r\nSelect instance from the table above to see detailed information.",
        "style": "upsell"
      },
      "name": "text - 7"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Detailed Information for: {InstanceName}",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where Instance_Name_s  == '{InstanceName}'\r\n| make-series requests = count() default = 0 on Timestamp_t from  ago(24h) to now() step 1h\r\n| render areachart ",
              "size": 0,
              "title": "Requests Over Time",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "50",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where Instance_Name_s  == '{InstanceName}'\r\n| make-series requests = count() default = 0 on Timestamp_t from  ago(24h) to now() step 1h by Source_IP_s \r\n| render areachart ",
              "size": 0,
              "title": "Requests by IP Address",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "50",
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where Instance_Name_s  contains '{InstanceName}'\r\n| summarize Requests = count() , FailedRequests = countif(Status_d != 200) , SuccesfullRequests = countif(Status_d  == 200) by URIPath = URI_Path_s\r\n| sort by Requests",
              "size": 0,
              "title": "Requests Summary by URI",
              "timeContext": {
                "durationMs": 86400000
              },
              "exportFieldName": "URIPath",
              "exportParameterName": "Path",
              "exportDefaultValue": "",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "55",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where Instance_Name_s  contains '{InstanceName}'\r\n| summarize Requests = count() , FailedRequests = countif(Status_d != 200) , SuccesfullRequests = countif(Status_d  == 200) by SourceIP = Source_IP_s",
              "size": 0,
              "title": "Requests Summary by IP",
              "timeContext": {
                "durationMs": 86400000
              },
              "exportFieldName": "SourceIP",
              "exportParameterName": "SourceIP",
              "exportDefaultValue": "",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "45",
            "name": "query - 0 - Copy"
          },
          {
            "type": 1,
            "content": {
              "json": "## Additional Information\r\nSelect a Path or Ip Address from the tables above to see detailed information.",
              "style": "upsell"
            },
            "name": "text - 8"
          }
        ],
        "exportParameters": true
      },
      "conditionalVisibility": {
        "parameterName": "InstanceName",
        "comparison": "isNotEqualTo",
        "value": ""
      },
      "name": "Detailed Information for: {InstanceName}"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where URI_Path_s == '{Path}'\r\n| summarize count() by ErrorMessage = Error_Message_s, URIPAth = URI_Path_s , Status = Status_d, SourceIP = Source_IP_s",
              "size": 0,
              "title": "Requests by Path: {Path}",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "55",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "apifirewall_log_1_CL\r\n| where Source_IP_s == '{SourceIP}'\r\n| summarize count() by ErrorMessage = Error_Message_s, URIPAth = URI_Path_s , Status = Status_d",
              "size": 0,
              "title": "Request by IP Address: {SourceIP}",
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "45",
            "name": "query - 0 - Copy"
          }
        ],
        "exportParameters": true
      },
      "conditionalVisibilities": [
        {
          "parameterName": "Path",
          "comparison": "isNotEqualTo"
        },
        {
          "parameterName": "SourceIP",
          "comparison": "isNotEqualTo"
        }
      ],
      "name": "group - 2"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-42CrunchAPIProtectionWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}