{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Vaikora AI Agent Behavioral Signals\n\nThis workbook visualizes AI agent behavioral data ingested from Vaikora into Microsoft Sentinel. Use it to monitor agent activity, detect anomalies, and investigate policy violations."
      },
      "name": "header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "timeRange",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "value": {
              "durationMs": 1209600000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                }
              ]
            }
          },
          {
            "id": "agentId",
            "version": "KqlParameterItem/1.0",
            "name": "AgentId",
            "label": "Agent ID",
            "type": 2,
            "query": "Vaikora_AgentSignals_CL | where isnotempty(agent_id_s) | summarize by agent_id_s | project value=agent_id_s, label=agent_id_s | take 50",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "defaultValue": "value::all",
            "queryType": 0
          }
        ],
        "style": "pills"
      },
      "name": "parameters"
    },
    {
      "type": 1,
      "content": {
        "json": "### Summary"
      },
      "name": "summary-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| summarize\n    TotalActions = count(),\n    BlockedActions = countif(policy_decision_s == 'block'),\n    Anomalies = countif(is_anomaly_b == true),\n    HighSeverity = countif(severity_s == 'high'),\n    CriticalSeverity = countif(severity_s == 'critical')\n| project TotalActions, BlockedActions, Anomalies, HighSeverity, CriticalSeverity",
        "size": 4,
        "title": "Signal Overview",
        "queryType": 0,
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": true,
          "titleContent": {
            "columnMatch": "",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "TotalActions",
            "formatter": 12,
            "formatOptions": {
              "palette": "blue"
            }
          }
        }
      },
      "name": "overview-tiles"
    },
    {
      "type": 1,
      "content": {
        "json": "### Actions Over Time"
      },
      "name": "timechart-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| summarize\n    TotalActions = count(),\n    Blocked = countif(policy_decision_s == 'block'),\n    Anomalies = countif(is_anomaly_b == true)\n  by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc",
        "size": 0,
        "title": "Agent Actions Over Time",
        "queryType": 0,
        "visualization": "timechart"
      },
      "name": "actions-timechart"
    },
    {
      "type": 1,
      "content": {
        "json": "### Actions by Severity"
      },
      "name": "severity-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| summarize Count = count() by severity_s\n| order by Count desc",
        "size": 3,
        "title": "Actions by Severity",
        "queryType": 0,
        "visualization": "piechart"
      },
      "name": "severity-pie"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| summarize Count = count() by policy_decision_s\n| order by Count desc",
        "size": 3,
        "title": "Actions by Policy Decision",
        "queryType": 0,
        "visualization": "piechart"
      },
      "name": "policy-pie"
    },
    {
      "type": 1,
      "content": {
        "json": "### Anomaly Detection"
      },
      "name": "anomaly-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| where is_anomaly_b == true\n| summarize Count = count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc",
        "size": 0,
        "title": "Anomalies Over Time",
        "queryType": 0,
        "visualization": "timechart",
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "Count",
              "color": "orange"
            }
          ]
        }
      },
      "name": "anomaly-timechart"
    },
    {
      "type": 1,
      "content": {
        "json": "### Recent High-Risk Actions"
      },
      "name": "highrisk-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| where severity_s in ('high', 'critical')\n| project TimeGenerated, agent_id_s, action_type_s, severity_s, anomaly_score_d, policy_decision_s, status_s, resource_type_s, action_id_s\n| order by TimeGenerated desc\n| take 50",
        "size": 0,
        "title": "Recent High-Risk Actions (top 50)",
        "queryType": 0,
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "severity_s",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {
                    "operator": "==",
                    "thresholdValue": "critical",
                    "representation": "red",
                    "text": "{0}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "high",
                    "representation": "orange",
                    "text": "{0}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "blue",
                    "text": "{0}"
                  }
                ]
              }
            },
            {
              "columnMatch": "policy_decision_s",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {
                    "operator": "==",
                    "thresholdValue": "block",
                    "representation": "red",
                    "text": "{0}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "green",
                    "text": "{0}"
                  }
                ]
              }
            }
          ]
        }
      },
      "name": "highrisk-table"
    },
    {
      "type": 1,
      "content": {
        "json": "### Policy Violations"
      },
      "name": "violations-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Vaikora_AgentSignals_CL\n| where TimeGenerated {TimeRange}\n| where isnotempty(agent_id_s)\n| where policy_decision_s == 'block'\n| summarize\n    ViolationCount = count(),\n    MaxAnomalyScore = max(anomaly_score_d),\n    Actions = make_set(action_type_s),\n    Resources = make_set(resource_type_s),\n    LastSeen = max(TimeGenerated)\n  by AgentId = agent_id_s, PolicyId = policy_id_s\n| extend ActionList = strcat_array(Actions, ', '), ResourceList = strcat_array(Resources, ', ')\n| project AgentId, PolicyId, ViolationCount, MaxAnomalyScore, ActionList, ResourceList, LastSeen\n| order by ViolationCount desc",
        "size": 0,
        "title": "Policy Violations by Agent and Policy",
        "queryType": 0,
        "visualization": "table"
      },
      "name": "violations-table"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-VaikoraAgentSignalsDashboard",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}