{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# TacitRed SecOps - Compromised Credentials\n\n**Purpose:** Triage and monitor compromised accounts detected by TacitRed.\n\nUse this workbook to validate data quality, understand volume and confidence of findings, and support SecOps investigations."
      },
      "name": "header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "time-range",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 604800000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 86400000,
                  "label": "24 hours"
                },
                {
                  "durationMs": 604800000,
                  "label": "7 days"
                },
                {
                  "durationMs": 2592000000,
                  "label": "30 days"
                }
              ],
              "allowCustom": true
            },
            "label": "Time Range"
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TacitRed_Findings_CL | where TimeGenerated >= ago(7d) | summarize Total = count(), HasEmail = countif(isnotempty(email_s)), HasDomain = countif(isnotempty(domain_s)), HasConfidence = countif(isnotnull(confidence_d)), HasStatus = countif(isnotempty(status_s)) | extend EmailPct = round(HasEmail * 100.0 / Total, 2), DomainPct = round(HasDomain * 100.0 / Total, 2), ConfidencePct = round(HasConfidence * 100.0 / Total, 2), StatusPct = round(HasStatus * 100.0 / Total, 2)",
        "size": 0,
        "title": "Data Quality - TacitRed Findings",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "data-quality"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "TacitRed_Findings_CL | where TimeGenerated {TimeRange} | extend Confidence = toint(confidence_d) | summarize TotalFindings = count(), UniqueEmails = dcount(email_s), UniqueDomains = dcount(domain_s), HighConfidence = countif(Confidence >= 80), MediumConfidence = countif(Confidence >= 60 and Confidence < 80), LowConfidence = countif(Confidence < 60)",
        "size": 0,
        "title": "Compromised Credentials Overview",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "overview"
    }
  ]
}