{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Overview\n---\nGet best-in-class APM from the category leader. Automatic and intelligent observability at scale for cloud native workloads and enterprise apps helps you ensure end-to-end hybrid cloud distributed tracing, optimize service performance, innovate faster, collaborate efficiently, and deliver more value with less effort."
      },
      "name": "text - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let tmp = datatable(id:string, TimeStamp:datetime, Type:string) [];\n\nlet attacks=DynatraceAttacks\n    | project id=AttackId, TimeStamp, Type=\"attacks\";\n\nlet problems=DynatraceProblems\n    | project id=ProblemId, TimeStamp=StartTime, Type=\"problems\";\n\nlet securityProblems=DynatraceSecurityProblems\n    | project id=SecurityProblemId, TimeStamp=LastUpdatedTimeStamp, Type=\"vulnerabilities\";\n\ntmp\n| union attacks, problems, securityProblems\n| summarize  arg_max(TimeStamp, *) by id\n| summarize  count() by Type\n| render piechart;",
        "size": 0,
        "title": "Dynatrace Events by Type",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "DynatraceEventsbyType"
    },
    {
      "type": 1,
      "content": {
        "json": "## Application Events\n---\n"
      },
      "name": "ApplicationsAndMicroservices"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DynatraceProblems \n| summarize  arg_max(StartTime, *) by ProblemId\n| summarize count() by SeverityLevel\n| render piechart",
        "size": 1,
        "title": "Events By Problem Type",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "EventsByProblemType"
    },
    {
      "type": 1,
      "content": {
        "json": "## Application Security Events\n---\nEmpower DevSecOps at scale with a unique approach to securing cloud-native applications at runtime combined with intelligent automation."
      },
      "name": "ApplicationSecurity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DynatraceSecurityProblems \n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n| summarize count() by Severity\n| render piechart",
        "size": 0,
        "title": "Vulnerabilities by Severity",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "SecurityProblemsBySeverity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DynatraceAttacks\n| summarize  arg_max(TimeStamp, *) by AttackId \n| summarize count() by AttackType \n| render piechart",
        "size": 1,
        "title": "Attacks By Attack Type",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "AttacksByAttackType"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DynatraceSecurityProblems \n| summarize  arg_max(LastUpdatedTimeStamp, *) by SecurityProblemId\n| summarize count() by Technology, ExternalVulnerabilityId\n| render piechart;",
        "size": 0,
        "title": "Vulnerability Count by Technology",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "VulnerabilityCountbyTechnology"
    },
    {
      "type": 1,
      "content": {
        "json": "## Tenant Audit Events\n---\nAudit logs are crucial for tracking changes and security-relevant events. Dynatrace can log such events so that you can review important changes: when the change was made, by whom, and what was changed."
      },
      "name": "TenantAuditing"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "DynatraceAuditLogs \n| summarize  arg_max(TimeStamp, *) by LogId \n| where Category in (\"WEB_UI\",\"TOKEN\")\n| summarize count() by Operation=strcat(EventType , \"-\" , Category)\n| render piechart",
        "size": 0,
        "title": "Audit Events By Type",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "AuditLogEventsByType"
    }
  ],
  "fromTemplateId": "sentinel-DynatraceWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}