{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": ">**NOTE:** This workbook uses a parser based on a Kusto Function to normalize fields. [Follow these steps](https://aka.ms/sentinel-SlackAuditAPI-parser) to create the Kusto function alias **SlackAudit**.\n\n## Prerequisites\nEnsure the Slack audit data connector and the SlackAudit parser function are deployed in the same workspace before using this workbook. If the function or table is missing, queries will return no results."
      },
      "name": "text - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "e34269c3-8c77-4e2c-aacb-b86537b2fa1d",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Slack User Activity",
            "subTarget": "slack_user_activity",
            "preText": "Slack User Activity",
            "style": "link"
          },
          {
            "id": "6d5f697d-6098-4196-bba8-843fefeeb2de",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Slack App Activity",
            "subTarget": "slack_app_activity",
            "style": "link"
          },
          {
            "id": "0be65784-c532-422e-9086-58b4de769e34",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Slack File Activity",
            "subTarget": "slack_file_activity",
            "style": "link"
          },
          {
            "id": "3ea7ee87-1041-4002-8169-8491ff5d0435",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Slack Channels Activity",
            "subTarget": "slack_channels_activity",
            "style": "link"
          }
        ]
      },
      "name": "links - 10"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "6b5965ee-e865-485e-b361-22f71c9ae4f1",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2419200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit \n| extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n | where Action startswith \"user\" | summarize count() by Action",
        "size": 3,
        "title": "Users Action Chart",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_0",
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "33",
      "name": "Users Action Chart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"user_login\"\n|make-series Trend = count(SrcUserEmail) on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SrcUserEmail;",
        "size": 0,
        "title": "Successful Logins over Time",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_1",
        "timeContextFromParameter": "TimeRange"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "33",
      "name": "Successful Logins over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"user_login_failed\"\n|make-series Trend = count(SrcUserEmail) on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SrcUserEmail;",
        "size": 3,
        "title": "Failed Logins over Time",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_2",
        "timeContextFromParameter": "TimeRange"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "33",
      "name": "Failed Logins over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"user_login\"\n| summarize Login = count() by Time=evt_time, Email=ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName | sort by Time ",
        "size": 3,
        "title": "Login Activity",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "rowLimit": 20,
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true,
        "timeContextFromParameter": "TimeRange",
        "exportParameterName": "SelectedRow_0"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "50",
      "name": "Login Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"user_created\"\n| project Time=evt_time, Email=ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName,Created_User=EntityUserEmail, Action, ActionDescription | sort by Time",
        "size": 3,
        "title": "Users Created",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "rowLimit": 20,
          "showExportToExcel": true
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true,
        "exportParameterName": "SelectedRow_1"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "50",
      "name": "Users Created"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Guest_Created_list = \nSlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"guest_created\" | summarize make_list(EntityUserEmail);\nlet Guest_Actions =\n SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where ActorUserEmail in (Guest_Created_list)\n | extend UserAct = strcat(ActorUserEmail,\" - \",Action);\n Guest_Actions | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by UserAct",
        "size": 0,
        "title": "New Guest Users Activity Timechart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "graphSettings": {
          "type": 0
        },
        "mapSettings": {
          "locInfo": "LatLong"
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "exportParameterName": "SelectedRow_2"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "50",
      "name": "New Guest Users Activity Timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"user_deactivated\"\n| project Time=evt_time, Email=ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName,Deactivated_User=EntityUserEmail, Action, ActionDescription | sort by Time",
        "size": 0,
        "title": "Users Deactivated",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "50",
      "name": "Users Deactivated"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let Guest_Created_list = \nSlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action == \"guest_created\" | summarize make_list(EntityUserEmail);\nlet Guest_Actions =\n SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n| where ActorUserEmail in (Guest_Created_list);\n Guest_Actions | project Time=evt_time, GuestEmail=ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription | sort by Time",
        "size": 0,
        "title": "New Guest Users Activity ",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_user_activity"
      },
      "customWidth": "50",
      "name": "New Guest Users Activity "
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_installed\" or Action == \"app_approved\" or Action == \"app_restricted\"\n | extend Action = case(Action == \"app_installed\", \"Applications Installed\", \n                       Action == \"app_approved\", \"Applications Approved\", \n                       \"Applications Restricted\")\n | summarize count() by Action",
        "size": 1,
        "title": "Application Actions",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Action",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "100",
      "name": "Application Actions"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_installed\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName \n | summarize Count=count() by App | sort by Count desc",
        "size": 0,
        "title": "Apps Installed Chart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Installed Chart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_installed\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName | sort by Time",
        "size": 0,
        "title": "Apps Installed",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Installed"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_restricted\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName | sort by Time",
        "size": 0,
        "title": "Apps Restricted",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Restricted"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_restricted\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName \n | summarize Count=count() by App | sort by Count desc",
        "size": 0,
        "title": "Apps Restricted Chart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Restricted Chart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_approved\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName | sort by Time",
        "size": 0,
        "title": "Apps Approved",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Approved"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"app_approved\"\n |  project Time=evt_time, ActorUserEmail, Context_Domain_Location=ContextLocationDomain, IP=ContextIpAddress, ContextLocationName = ContextLocationName, Action, ActionDescription, AppScopes =EntityAppScopes, App=EntityAppName \n | summarize Count=count() by App | sort by Count desc",
        "size": 0,
        "title": "Apps Approved Chart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_app_activity"
      },
      "customWidth": "50",
      "name": "Apps Approved Chart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_downloaded\" or Action == \"file_uploaded\" or Action == \"file_shared\" or Action == \"file_public_link_created\" or Action == \"file_public_link_revoked\" or Action == \"file_downloaded_blocked\"\n | extend Action = case(Action == \"file_downloaded\", \"Downloaded\", Action == \"file_uploaded\", \"Uploaded\", Action == \"file_shared\",\"Shared\", Action == \"file_public_link_created\", \"Public Link Created\",Action == \"file_public_link_revoked\", \"Public Link Revoked\",\"Download Blocked\" )\n | summarize count() by Action | sort by count_ desc",
        "size": 1,
        "title": "File Actions",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Action",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "name": "File Actions"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_downloaded\"\n | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActorUserEmail;",
        "size": 0,
        "title": "File Downloads Activity TImechart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Downloads Activity TImechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_downloaded\"\n | project Time =evt_time, Workspace=ContextLocationName, [\"File Title\"] = EntityFileTitle, User = ActorUserName, Action, ActionDescription\n | sort by Time desc | take 25",
        "size": 0,
        "title": "File Downloads Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Downloads Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where Action == \"file_uploaded\"\n | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActorUserEmail;",
        "size": 0,
        "title": "File Uploads Activity Timechart",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "timeContextFromParameter": "TimeRange"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Uploads Activity Timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_uploaded\"\n | project Time =evt_time, Workspace=ContextLocationName, [\"File Title\"] = EntityFileTitle, User = ActorUserName, Action, ActionDescription\n | sort by Time desc | take 25",
        "size": 0,
        "title": "File Uploads Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Uploads Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_shared\"\n | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActorUserEmail;",
        "size": 0,
        "title": "Shared Files Activity Timechart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "Shared Files Activity Timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_shared\"\n | project Time =evt_time, Workspace=ContextLocationName, [\"File Title\"] = EntityFileTitle, User = ActorUserName, Action, ActionDescription\n | sort by Time desc | take 25",
        "size": 0,
        "title": "Shared Files Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "Shared Files Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_public_link_created\"\n | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActorUserEmail;",
        "size": 0,
        "title": "File Public Link Created Activity Timechart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Public Link Created Activity Timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_public_link_created\"\n | project Time =evt_time, Workspace=ContextLocationName, [\"File Title\"] = EntityFileTitle, User = ActorUserName, Action, ActionDescription\n | sort by Time desc | take 25",
        "size": 0,
        "title": "File Public Link Created Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Public Link Created Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_public_link_revoked\"\n | make-series Trend = count() on evt_time from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ActorUserEmail;",
        "size": 0,
        "title": "File Public Link Revoked Activity Timechart",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Public Link Revoked Activity Timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": " SlackAudit\n | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n | where evt_time {TimeRange}\n | where Action == \"file_public_link_revoked\"\n | project Time =evt_time, Workspace=ContextLocationName, [\"File Title\"] = EntityFileTitle, User = ActorUserName, Action, ActionDescription\n | sort by Time desc | take 25",
        "size": 0,
        "title": "File Public Link Revoked Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_file_activity"
      },
      "customWidth": "50",
      "name": "File Public Link Revoked Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "\nSlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where Action contains \"_channel_\"\n| summarize count() by ActionDescription | sort by count_ desc",
        "size": 1,
        "title": "Channels Activity",
        "timeContext": {
          "durationMs": 172800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "ActionDescription",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "useGrouping": false,
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "showBorder": false
        },
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "timeContextFromParameter": "TimeRange"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "name": "Channels Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"private_channel\"\n| summarize count() by ActionDescription",
        "size": 0,
        "title": "Private Channels Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "Private Channels Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"private_channel\"\n| project Time=evt_time, ActorUser=ActorUserEmail, Action, ActionDescription, [\"Channel Name\"]= EntityChannelName, ContextLocationDomain, Ip=ContextIpAddress, EntityChannelIsShared,EntityChannelIsOrgShared\n| sort by Time",
        "size": 0,
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true,
        "title": "Query: SlackAudit | extend evt_time = unixtime_seconds_to..."
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "PrivateChannelActivity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"public_channel\"\n| summarize count() by ActionDescription",
        "size": 0,
        "title": "Public Channels Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "Public Channels Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"public_channel\"\n| project Time=evt_time, ActorUser=ActorUserEmail, Action, ActionDescription, [\"Channel Name\"]= EntityChannelName, ContextLocationDomain, Ip=ContextIpAddress, EntityChannelIsShared,EntityChannelIsOrgShared\n| sort by Time",
        "size": 0,
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true,
        "title": "Query: SlackAudit | extend evt_time = unixtime_seconds_to..."
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "PublicChannelActivity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"guest_channel\"\n| summarize count() by ActionDescription",
        "size": 0,
        "title": "Guest Channels Activity",
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "Guest Channels Activity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SlackAudit | extend evt_time = unixtime_seconds_todatetime(EventEndTime)\n| where evt_time {TimeRange}\n| where Action contains \"guest_channel\"\n| project Time=evt_time, ActorUser=ActorUserEmail, Action, ActionDescription, [\"Channel Name\"]= EntityChannelName, ContextLocationDomain, Ip=ContextIpAddress, EntityChannelIsShared,EntityChannelIsOrgShared\n| sort by Time",
        "size": 0,
        "timeContext": {
          "durationMs": 2419200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "noDataMessage": "No data found for the selected time range and filters. Verify the data connector is enabled and data is flowing.",
        "noDataMessageStyle": 3,
        "showExportToExcel": true,
        "title": "Query: SlackAudit | extend evt_time = unixtime_seconds_to..."
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "slack_channels_activity"
      },
      "customWidth": "50",
      "name": "GuestChannelActivity"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-SlackAudit",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}