{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 1800000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 3600000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 14400000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 43200000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 86400000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 172800000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 259200000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 604800000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 1209600000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 2592000000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 5184000000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                },
                {
                  "durationMs": 7776000000,
                  "createdTime": "2019-03-04T13:46:59.079Z",
                  "isInitialTime": false,
                  "grain": 1,
                  "useDashboardTimeRange": false
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "above",
        "queryType": 1,
        "resourceType": "microsoft.resourcegraph/resources"
      },
      "name": "parameters - 2"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "b14a1882-985b-43fe-b254-6f3f4b67f1a4",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Security Events",
            "subTarget": "SecurityEvents",
            "style": "link"
          },
          {
            "id": "3954c8da-8586-46d8-a04b-5d6f76eaa198",
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Configuration Changes",
            "subTarget": "ConfigurationChanges",
            "style": "link"
          }
        ]
      },
      "name": "links - 14"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| summarize count() by bin(Timestamp, 1d)",
        "size": 1,
        "aggregation": 4,
        "showAnnotations": true,
        "title": "Security Events Trend",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "name": "query - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| summarize count() by srcIp\r\n| sort by count_ desc",
        "size": 0,
        "title": "Events by Source IP",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "OperationCount",
              "formatter": 3,
              "formatOptions": {
                "showIcon": true
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "query - 7 - Copy - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| summarize count() by destIp\r\n| sort by count_ desc",
        "size": 0,
        "title": "Events by Destination IP",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "OperationCount",
              "formatter": 3,
              "formatOptions": {
                "showIcon": true
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "query - 7 - Copy - Copy - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Events by IP",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MerakiSecurityEvents\r\n| summarize count() by protocol\r\n| render piechart",
              "size": 4,
              "title": "Events by Protocol",
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MerakiSecurityEvents\r\n| summarize count() by blocked",
              "size": 4,
              "title": "Events by Block State",
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "tileSettings": {
                "showBorder": false
              }
            },
            "name": "query - 1"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "group - 17",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| summarize count() by srcPort\r\n| sort by count_ desc",
        "size": 0,
        "title": "Events by Source Port",
        "timeContext": {
          "durationMs": 0
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "query - 12",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| summarize count() by destPort\r\n| sort by count_ desc",
        "size": 0,
        "title": "Events by Destination Port",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "query - 13",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Events by Port",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MerakiSecurityEvents\r\n| summarize count() by srcPort",
              "size": 4,
              "title": "Events by Source Port",
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MerakiSecurityEvents\r\n| summarize count() by destPort",
              "size": 4,
              "title": "Events by Destination Port",
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "name": "query - 0 - Copy"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "customWidth": "33",
      "name": "group - 17 - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiSecurityEvents\r\n| sort by Timestamp desc",
        "size": 0,
        "title": "Raw Security Events",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "SecurityEvents"
      },
      "name": "query - 35 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiConfigurationChanges\r\n| summarize count() by bin(Timestamp, 1d)",
        "size": 1,
        "aggregation": 4,
        "showAnnotations": true,
        "title": "Audit Events Trend",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "ConfigurationChanges"
      },
      "name": "query - 4 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiConfigurationChanges\r\n| summarize count() by adminEmail\r\n| sort by count_ desc",
        "size": 0,
        "title": "Top Events - By AdminEmail",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "OperationCount",
              "formatter": 3,
              "formatOptions": {
                "showIcon": true
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "ConfigurationChanges"
      },
      "customWidth": "33",
      "name": "query - 8"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiConfigurationChanges\r\n| summarize PageCount=count() by page\r\n| sort by PageCount desc",
        "size": 0,
        "title": "Top Events - By Page",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "OperationCount",
              "formatter": 3,
              "formatOptions": {
                "showIcon": true
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "ConfigurationChanges"
      },
      "customWidth": "33",
      "name": "query - 7 - Copy"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiConfigurationChanges\r\n| summarize LabelCount=count() by label\r\n| sort by LabelCount desc",
        "size": 0,
        "title": "Top Events - By Label",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "OperationCount",
              "formatter": 3,
              "formatOptions": {
                "showIcon": true
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "ConfigurationChanges"
      },
      "customWidth": "33",
      "name": "query - 7"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "MerakiConfigurationChanges\r\n| sort by Timestamp desc",
        "size": 0,
        "title": "Raw Audit Events",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "ConfigurationChanges"
      },
      "name": "query - 35"
    }
  ],
  "fromTemplateId": "sentinel-CiscoMeraki",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}