{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "<a href=\"https://www.authomize.com/\" target=\"_blank\">\n<img width=\"211\" src=\"https://www.authomize.com/wp-content/themes/authomize/img/automize%20logo_horizontal%20authomize%20logo%20on%20white.svg\"/>\n</a>\n# Authomize ITDR\n---"
      },
      "name": "text - 2",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union withsource=_TableName Authomize_v2_CL\n| where TimeGenerated > ago(5d)\n| summarize Count=count() by TimeGenerated\n| render barchart\n",
        "size": 1,
        "title": "Event Processing from Authomize tenant",
        "color": "green",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "chartSettings": {
          "group": "TimeGenerated",
          "createOtherGroup": null
        }
      },
      "name": "Check Events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union withsource=_TableName Authomize_v2_CL\n| summarize Count=count() by Category",
        "size": 0,
        "title": "Event Category",
        "timeContext": {
          "durationMs": 604800000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Category",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Category",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "mapSettings": {
          "locInfo": "LatLong"
        }
      },
      "name": "query - 7"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Events to Process",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union withsource=_TableName Authomize_v2_CL\n| summarize Count=count() by severity_s\n| render piechart",
              "size": 2,
              "title": "Events by Severity",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "severity_s",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "chartSettings": {
                "showLegend": true,
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 0,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 3",
            "styleSettings": {
              "showBorder": true
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union withsource=_TableName Authomize_v2_CL\n| extend Policy = policy_name_s\n| extend Severity = severity_s\n| extend Description = description_s\n| extend Recommendation = recommendation_s\n| extend URL = url_s\n| extend Tactics = tactics_s\n//| where policy_name_s contains tostring(this_event)\n| project  Policy, Severity, Description, Recommendation, URL, Category, Tactics",
              "size": 2,
              "title": "Events",
              "timeContext": {
                "durationMs": 259200000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "URL",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "Url"
                    }
                  },
                  {
                    "columnMatch": "url_s",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "Url"
                    }
                  }
                ],
                "rowLimit": 1000
              },
              "sortBy": []
            },
            "customWidth": "50",
            "name": "query - 6",
            "styleSettings": {
              "maxWidth": "50",
              "showBorder": true
            }
          }
        ]
      },
      "name": "EventsToProcess"
    },
    {
      "type": 1,
      "content": {
        "json": "# Select an Event Type"
      },
      "name": "text - 5"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Events Grouped",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "union withsource=_TableName Authomize_v2_CL\n| extend Event_Type = policy_name_s\n| summarize Count = count() by Event_Type",
              "size": 0,
              "timeContext": {
                "durationMs": 604800000
              },
              "exportMultipleValues": true,
              "exportedParameters": [
                {
                  "fieldName": "Event_Type",
                  "parameterName": "theEventType"
                }
              ],
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "50",
            "name": "Grouped Events",
            "styleSettings": {
              "maxWidth": "50"
            }
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let the_Event=dynamic({theEventType});\nunion withsource=_TableName Authomize_v2_CL\n| extend Severity = severity_s\n| extend Description = description_s\n| extend Recommendation = recommendation_s\n| extend URL = url_s\n| where policy_name_s contains tostring(the_Event)\n| project Severity, Description, Recommendation, URL, Category",
              "size": 0,
              "timeContext": {
                "durationMs": 604800000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "URL",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "Url"
                    }
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "query - 5",
            "styleSettings": {
              "maxWidth": "50"
            }
          }
        ]
      },
      "name": "MultiSelect",
      "styleSettings": {
        "showBorder": true
      }
    }
  ],
  "styleSettings": {
    "paddingStyle": "narrow",
    "spacingStyle": "narrow"
  },
  "fromTemplateId": "sentinel-AuthomizeWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}