{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Keeper Security Audit Logs Analysis"
      },
      "name": "text - 1"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "crossComponentResources": [
          "{Subscription}"
        ],
        "parameters": [
          {
            "id": "1ca69445-60fc-4806-b43d-ac7e6aad630a",
            "version": "KqlParameterItem/1.0",
            "name": "Subscription",
            "type": 6,
            "isRequired": true,
            "value": "/subscriptions/8c6a2ccf-3647-416c-b18c-4d9299c73e59",
            "typeSettings": {
              "includeAll": false
            },
            "label": "☁️ Subscription"
          },
          {
            "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511",
            "version": "KqlParameterItem/1.0",
            "name": "Workspace",
            "type": 5,
            "isRequired": true,
            "query": "Resources \n| where type =~ \"microsoft.operationalinsights/workspaces\" \n| order by name \n| project id, name, selected=row_number()==1, group=resourceGroup",
            "crossComponentResources": [
              "{Subscription}"
            ],
            "typeSettings": {
              "resourceTypeFilter": {
                "microsoft.operationalinsights/workspaces": true
              }
            },
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources",
            "label": "🗂️ Workspace",
            "value": ""
          },
          {
            "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2592000000
                }
              ],
              "allowCustom": true
            },
            "label": "⏱️ Time Range"
          }
        ],
        "style": "above",
        "queryType": 1,
        "resourceType": "microsoft.resourcegraph/resources"
      },
      "name": "parameters - 1"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "182ff415-dc4f-42d3-a39a-eab397510bc7",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Overview",
            "subTarget": "Overview",
            "style": "link"
          },
          {
            "id": "0d78c03f-f8d7-40da-8761-3ef454b14ad8",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "User Analysis",
            "subTarget": "UserAnalysis",
            "style": "link"
          },
          {
            "id": "security-events-tab",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Security Events",
            "subTarget": "SecurityEvents",
            "style": "link"
          }
        ]
      },
      "name": "links - tabs"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Overview",
        "loadType": "always",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize count() by bin(TimeGenerated, 1h), Category\n| order by TimeGenerated asc",
              "size": 1,
              "title": "Events Over Time by Category",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "areachart"
            },
            "name": "events-timeline"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where isnotempty(RemoteAddress)\n| extend GeoIP = geo_info_from_ip_address(RemoteAddress)\n| extend Country = tostring(GeoIP.country), City = tostring(GeoIP.city)\n| extend Latitude = toreal(GeoIP.latitude), Longitude = toreal(GeoIP.longitude)\n| where isnotempty(Country)\n| summarize EventCount = count() by Country, City, Latitude, Longitude\n| top 20 by EventCount",
              "size": 0,
              "title": "Geographic Distribution of Events",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "map",
              "mapSettings": {
                "locInfo": "CountryRegion",
                "locInfoColumn": "Country",
                "sizeSettings": "EventCount",
                "sizeAggregation": "Sum",
                "legendMetric": "EventCount",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "nodeColorField": "EventCount",
                  "colorAggregation": "Sum",
                  "type": "heatmap",
                  "heatmapPalette": "greenRed"
                }
              }
            },
            "customWidth": "50",
            "name": "geographic-map"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| distinct Username\n| count",
              "size": 4,
              "title": "Active Users",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false
              }
            },
            "customWidth": "25",
            "name": "active-users-tile"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize TotalEvents = count()\n| extend TotalEvents",
              "size": 4,
              "title": "Total Events",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "TotalEvents",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  }
                },
                "showBorder": false
              }
            },
            "customWidth": "25",
            "name": "total-events-tile"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize count() by Category\n| order by count_ desc",
              "size": 1,
              "title": "Events by Category",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "events-by-category"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize count() by AuditEvent\n| order by count_ desc\n| limit 10",
              "size": 1,
              "title": "Top 10 Audit Events",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "top-audit-events"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "Overview"
      },
      "name": "Group: Overview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "User Analysis",
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "user-selection-method",
                  "version": "KqlParameterItem/1.0",
                  "name": "UserSelectionMethod",
                  "label": "Select User Method",
                  "type": 10,
                  "isRequired": true,
                  "typeSettings": {
                    "showDefault": false
                  },
                  "jsonData": "[\n {\"value\": \"name\", \"label\": \"Select User by Name\", \"selected\":true },\n {\"value\": \"search\", \"label\": \"Search User\"}\n]",
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "user-selection-method"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "selected-username",
                  "version": "KqlParameterItem/1.0",
                  "name": "SelectedUsername",
                  "label": "Select User",
                  "type": 2,
                  "isRequired": true,
                  "query": "KeeperSecurityEventNewLogs_CL\n| where TimeGenerated {TimeRange:query}\n| where isnotempty(Username)\n| summarize Count = count() by Username\n| order by Count desc, Username asc\n| project Value = Username, Label = strcat(Username, ' - ', Count, ' events'), Selected = false",
                  "typeSettings": {
                    "showDefault": false
                  },
                  "timeContext": {
                    "durationMs": 2592000000
                  },
                  "timeContextFromParameter": "TimeRange",
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": ""
                }
              ],
              "style": "above",
              "doNotRunWhenHidden": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "conditionalVisibility": {
              "parameterName": "UserSelectionMethod",
              "comparison": "isEqualTo",
              "value": "name"
            },
            "name": "user-selection-dropdown"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where Username == '{SelectedUsername:query}'\n| where isnotempty(RemoteAddress)\n| extend GeoIP = geo_info_from_ip_address(RemoteAddress)\n| extend Country = tostring(GeoIP.country), City = tostring(GeoIP.city)\n| extend Latitude = toreal(GeoIP.latitude), Longitude = toreal(GeoIP.longitude)\n| where isnotempty(Country) and isnotempty(Latitude)\n| summarize EventCount = count() by Country, City, Latitude, Longitude\n| order by EventCount desc\n",
              "size": 0,
              "title": "User Geographic Activity:",
              "timeContextFromParameter": "TimeRange",
              "exportToExcelOptions": "all",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "map",
              "mapSettings": {
                "locInfo": "LatLong",
                "latitude": "Latitude",
                "longitude": "Longitude",
                "sizeSettings": "EventCount",
                "sizeAggregation": "Sum",
                "labelSettings": "City",
                "legendMetric": "EventCount",
                "legendAggregation": "Sum",
                "itemColorSettings": {
                  "type": "heatmap",
                  "colorAggregation": "Sum",
                  "nodeColorField": "EventCount",
                  "heatmapPalette": "categorical"
                }
              }
            },
            "customWidth": "50",
            "name": "user-geographic-activity"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where Username == '{SelectedUsername:query}'\n| summarize count() by bin(TimeGenerated, 1h)\n| order by TimeGenerated asc",
              "size": 1,
              "title": "User Activity Pattern: {SelectedUsername}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "areachart"
            },
            "customWidth": "50",
            "name": "user-activity-pattern"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where Username == '{SelectedUsername:query}'\n| extend GeoIP = geo_info_from_ip_address(RemoteAddress)\n| extend Country = tostring(GeoIP.country), City = tostring(GeoIP.city)\n| project TimeGenerated, Username, AuditEvent, Category, RemoteAddress, City, Country, ClientVersion, Data\n| order by TimeGenerated desc",
              "size": 1,
              "title": "Detailed Activity for User: {SelectedUsername}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "TimeGenerated",
                    "formatter": 6
                  },
                  {
                    "columnMatch": "RemoteAddress",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "colors",
                      "thresholdsGrid": [
                        {
                          "operator": "Default",
                          "representation": "gray"
                        }
                      ]
                    }
                  }
                ],
                "filter": true
              }
            },
            "name": "user-detailed-activity"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where Username == '{SelectedUsername:query}'\n| summarize count() by Category\n| order by count_ desc",
              "size": 4,
              "title": "Event Categories for {SelectedUsername}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "user-event-categories"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| where Username == '{SelectedUsername}'\n| summarize count() by AuditEvent\n| order by count_ desc\n| limit 10",
              "size": 4,
              "title": "Top Audit Events: {SelectedUsername}",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "user-top-events"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "UserAnalysis"
      },
      "name": "Group: UserAnalysis"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Security Events",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| extend GeoIP = geo_info_from_ip_address(RemoteAddress)\n| extend Country = tostring(GeoIP.country)\n| where isnotempty(Country)\n| summarize UniqueUsers = dcount(Username), TotalEvents = count() by Country\n| order by TotalEvents desc\n| limit 20",
              "size": 1,
              "title": "Security Events by Country",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "TotalEvents",
                    "formatter": 3,
                    "formatOptions": {
                      "palette": "greenRed"
                    }
                  },
                  {
                    "columnMatch": "UniqueUsers",
                    "formatter": 3,
                    "formatOptions": {
                      "palette": "blue"
                    }
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "security-events-by-country"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize EventCount = count() by Username\n| order by EventCount desc\n| limit 20",
              "size": 1,
              "title": "Most Active Users",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "most-active-users"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| extend Hour = datetime_part('hour', TimeGenerated)\n| summarize EventCount = count() by Hour\n| order by Hour asc",
              "size": 1,
              "title": "Activity by Hour of Day",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "columnchart"
            },
            "name": "activity-by-hour"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "KeeperSecurityEventNewLogs_CL\n| summarize EventCount = count() by RemoteAddress\n| order by EventCount desc\n| limit 20",
              "size": 1,
              "title": "Top Source IP Addresses",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "RemoteAddress",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "colors",
                      "thresholdsGrid": [
                        {
                          "operator": "Default",
                          "representation": "gray"
                        }
                      ]
                    }
                  },
                  {
                    "columnMatch": "EventCount",
                    "formatter": 3,
                    "formatOptions": {
                      "palette": "greenRed"
                    }
                  }
                ]
              }
            },
            "name": "top-source-ips"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "name": "Group: SecurityEvents"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-KeeperSecurityDashboard",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}