{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "909e17ae-41a9-4f76-83ba-c8d6a5d49780",
            "version": "KqlParameterItem/1.0",
            "name": "DefaultSubscription_Internal",
            "type": 1,
            "query": "where type =~ 'microsoft.operationalinsights/workspaces'\r\n| take 1\r\n| project subscriptionId",
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "ac31c596-b13e-463d-8eaf-caef627e844a",
            "version": "KqlParameterItem/1.0",
            "name": "InternalWSs",
            "type": 1,
            "query": "SecurityIncident\r\n| take 1\r\n| parse IncidentUrl with * \"/workspaces/\" Workspace \"/\" *\r\n| project Workspace",
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "ad9329d3-470a-4a45-ab52-2a9f81372203",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "query": "summarize by subscriptionId\r\n| project value = strcat(\"/subscriptions/\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)",
            "isHiddenWhenLocked": true,
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "d3ed9f5f-b558-40e7-9ea9-2a8b3853e2e8",
            "version": "KqlParameterItem/1.0",
            "name": "Workspace",
            "type": 5,
            "query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| project subscriptionId,id,name\r\n| where '{Subscription}' has subscriptionId\r\n| project value =id, label = name, selected = iff(name =~ '{InternalWSs}', true, false)",
            "isHiddenWhenLocked": true,
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources",
            "value": null
          },
          {
            "id": "6f115f05-f48e-4ac4-8603-129c7afbc31e",
            "version": "KqlParameterItem/1.0",
            "name": "InternalRG",
            "type": 1,
            "query": "where type =~ \"microsoft.operationalinsights/workspaces\"\r\n| where id =~  \"{Workspace}\"\r\n| project resourceGroup",
            "isHiddenWhenLocked": true,
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources"
          },
          {
            "id": "ab4782bf-fdb2-4c4c-a850-ef92420d2f4b",
            "version": "KqlParameterItem/1.0",
            "name": "Watchlist",
            "type": 2,
            "query": "{\"version\":\"ARMEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"path\":\"{Subscription}/resourceGroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{InternalWSs}/providers/Microsoft.SecurityInsights/watchlists?api-version=2022-05-01\",\"urlParams\":[],\"batchDisabled\":false,\"transformers\":[{\"type\":\"jsonpath\",\"settings\":{\"tablePath\":\"$.value\",\"columns\":[]}}]}",
            "typeSettings": {
              "additionalResourceOptions": []
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 12,
            "label": "Watchlist to Modify",
            "value": null
          }
        ],
        "style": "pills",
        "queryType": 12
      },
      "name": "parameters - 1"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "a30180d1-89c7-4205-87c4-e882224065d8",
            "version": "KqlParameterItem/1.0",
            "name": "SelectType",
            "label": "Show Type",
            "type": 10,
            "isRequired": true,
            "query": "_GetWatchlist('SOCIRP')\r\n| project a = pack_array(Activity, \"1 : Show All\")\r\n| summarize a = make_set(a)\r\n| mv-expand a\r\n| order by tostring(a) asc",
            "value": "1 : Show All",
            "typeSettings": {
              "additionalResourceOptions": [],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "_GetWatchlist('SOCIRP')\r\n| where Type = iif('{SelectType}' ==\"1 : Show All\",true,Activity in ('{SelectType}') )\r\n| extend TodaysDate = now()\r\n| project Status, Activity, Benefit, Description, Date, _DTItemId, TodaysDate\r\n",
        "size": 1,
        "exportedParameters": [
          {
            "fieldName": "_DTItemId",
            "parameterName": "_DTItemId",
            "parameterType": 1
          },
          {
            "fieldName": "Status",
            "parameterName": "Status",
            "parameterType": 1
          },
          {
            "fieldName": "Activity",
            "parameterName": "Activity",
            "parameterType": 1
          },
          {
            "fieldName": "Benefit",
            "parameterName": "Benefit",
            "parameterType": 1
          },
          {
            "fieldName": "Description",
            "parameterName": "Description",
            "parameterType": 1
          },
          {
            "fieldName": "Date",
            "parameterName": "Date",
            "parameterType": 1
          },
          {
            "fieldName": "TodaysDate",
            "parameterName": "TodaysDate",
            "parameterType": 1
          }
        ],
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "rowLimit": 800,
          "filter": true
        },
        "sortBy": []
      },
      "name": "query - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview\r\n\r\nThe DTItemId is : **{_DTItemId}** <br>\r\nThe Status is : **{Status}** <br>\r\nThe Activity is : **{Activity}** <br>\r\nThe Benefit is : **{Benefit}** <br>\r\nThe Description is : **{Description}** <br>\r\nThe Date is : **{TodaysDate}**"
      },
      "name": "text - 1"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "list",
        "links": [
          {
            "id": "d9eeb79f-7025-438c-92a7-a988c09a4037",
            "linkTarget": "ArmAction",
            "linkLabel": "SAVE SOCIRP : In Progress",
            "style": "primary",
            "linkIsContextBlade": true,
            "armActionContext": {
              "path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
              "headers": [],
              "params": [],
              "body": "{ \r\n\t\"properties\": { \r\n\t\t\"itemsKeyValue\": {\r\n      \"DTItemId\":\"{_DTItemId}\",\r\n\t\t\t\"Status\": \"In Progress\",\r\n\t\t\t\"Activity\": \"{Activity}\",\r\n\t\t\t\"Benefit\" : \"{Benefit}\",\r\n\t\t\t\"Description\": \"{Description}\",\r\n\t\t\t\"Date\": \"{TodaysDate}\"\r\n\t\t}\r\n\t}\r\n}",
              "httpMethod": "PUT",
              "description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
            }
          },
          {
            "id": "fed80f87-5326-4832-aa27-7d1fc3d623d7",
            "linkTarget": "ArmAction",
            "linkLabel": "SAVE SOCIRP : Complete",
            "style": "primary",
            "linkIsContextBlade": true,
            "armActionContext": {
              "path": "{Watchlist}/watchlistitems/{_DTItemId}?api-version=2021-03-01-preview",
              "headers": [],
              "params": [],
              "body": "{ \r\n\t\"properties\": { \r\n\t\t\"itemsKeyValue\": {\r\n      \"DTItemId\":\"{_DTItemId}\",\r\n\t\t\t\"Status\": \"Complete\",\r\n\t\t\t\"Activity\": \"{Activity}\",\r\n\t\t\t\"Benefit\" : \"{Benefit}\",\r\n\t\t\t\"Description\": \"{Description}\",\r\n\t\t\t\"Date\": \"{TodaysDate}\"\r\n\t\t}\r\n\t}\r\n}",
              "httpMethod": "PUT",
              "description": "# ARM actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command."
            }
          }
        ]
      },
      "name": "links - 2"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-SOCIRPlanning",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}