{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "1f7d92a0-0398-464e-bda6-bb0d11882461",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 43200000
            }
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "83ab456b-ee0f-4e43-b5e6-6f2c2b9dea20",
            "cellValue": "TabName",
            "linkTarget": "parameter",
            "linkLabel": "Traffic Events",
            "subTarget": "TrafficEvents",
            "preText": "",
            "style": "link"
          },
          {
            "id": "5e6d0db1-203a-4308-a571-4631188565e0",
            "cellValue": "TabName",
            "linkTarget": "parameter",
            "linkLabel": "Risk Events",
            "subTarget": "RiskEvents",
            "style": "link"
          }
        ]
      },
      "name": "links - 3"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "548c3e58-0d78-4fff-b0e9-5b0a1b158704",
            "version": "KqlParameterItem/1.0",
            "name": "Action",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Traffic Logs\"\n| distinct Action\n| sort by Action asc",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "defaultValue": "value::all",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "8dbe7459-bdfd-42cc-bcbd-cde0e186cb90",
            "version": "KqlParameterItem/1.0",
            "name": "TrafficUserNames",
            "label": "User Name",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| distinct UserName\r\n| sort by UserName asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 3600000
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "d97c02ea-a7c9-4b8e-b439-4c7f63efa510",
            "version": "KqlParameterItem/1.0",
            "name": "TrafficIps",
            "label": "Local IP Address",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| distinct LocalHostIpAddr\r\n| sort by LocalHostIpAddr asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "name": "parameters - 4"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize Allowed = countif(Action == \"Allowed\"), Blocked = countif(Action == \"Blocked\") by bin(TimeGenerated,{TimeRange:grain})\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Action over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "60",
      "name": "Total Events by Action over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize count() by Action\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Action",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "40",
      "name": "Total Events by Action",
      "styleSettings": {
        "margin": "40"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize count() by LocalHostIpAddr, bin(TimeGenerated,{TimeRange:grain})\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by IP Address over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "60",
      "name": "Total Events by IP Address over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize Total = count() by LocalHostIpAddr\r\n| project-rename ['IP Address'] = LocalHostIpAddr\r\n| top 10 by Total\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 IP Addresses",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        },
        "sortBy": []
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "40",
      "name": "Top 10 IP Addresses",
      "styleSettings": {
        "margin": "40"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize count() by UserName, bin(TimeGenerated,{TimeRange:grain})\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by User over Time",
        "timeContext": {
          "durationMs": 86400000
        },
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "60",
      "name": "Total Events by User over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\r\n| where LogType == \"Agent Traffic Logs\"\r\n| where Action in ({Action}) or '*' in ({Action})\r\n| where UserName in ({TrafficUserNames}) or '*' in ({TrafficUserNames})\r\n| where LocalHostIpAddr in ({TrafficIps}) or '*' in ({TrafficIps})\r\n| summarize Total = count() by UserName\r\n| top 10 by Total\r\n\r\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 User Names",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        },
        "sortBy": []
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "TrafficEvents"
      },
      "customWidth": "40",
      "name": "Top 10 User Names",
      "styleSettings": {
        "margin": "40"
      }
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "9fb20767-f8b7-4558-90b9-e8b9e3c5ec7f",
            "version": "KqlParameterItem/1.0",
            "name": "RiskCategory",
            "label": "Risk Category",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| distinct CategorySet\n| sort by CategorySet asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 1800000
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "cd01c3ca-efe4-4a4a-93ec-b89f6ceeec84",
            "version": "KqlParameterItem/1.0",
            "name": "RiskNames",
            "label": "Risk Name",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| distinct RiskName\n| sort by RiskName",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "cdb8e863-b200-4b34-a605-d5b5eb635add",
            "version": "KqlParameterItem/1.0",
            "name": "UserNames",
            "label": "User Name",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| distinct UserName\n| sort by UserName asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 1800000
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "fb274685-dc71-4721-8191-85735fc095c9",
            "version": "KqlParameterItem/1.0",
            "name": "IPAddress",
            "label": "IP Address",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| distinct SrcIpAddr\n| sort by SrcIpAddr asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "a685767f-1c2b-4bfc-8ea2-5c1aca57b6ab",
            "version": "KqlParameterItem/1.0",
            "name": "Hostnames",
            "label": "Hostname",
            "type": 2,
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| distinct SrcHostName\n| sort by SrcHostName asc",
            "value": [
              "value::all"
            ],
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ]
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "name": "parameters - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize count() by CategorySet, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Risk Category over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "60",
      "name": "Total Events by Risk Category over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize count() by CategorySet",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Risk Category",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "40",
      "name": "Total Events by Risk Category"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize Total = count() by RiskName\n| top 10 by Total\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 Risk Name",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "40",
      "name": "Top 10 Risk Name"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize count() by RiskName, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by Risk Name over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "60",
      "name": "Total Events by Risk Name over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize count() by SrcIpAddr, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by IP Address over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "60",
      "name": "Total Events by IP Address over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize Total = count() by SrcIpAddr, SrcHostName\n| project-rename ['Source IP'] = SrcIpAddr, Hostname = SrcHostName\n| top 10 by Total\n",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 IP Addresses",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "40",
      "name": "Top 10 IP Addresses"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize count() by UserName, bin(TimeGenerated, {TimeRange:grain})",
        "size": 0,
        "showAnalytics": true,
        "title": "Total Events by User over Time",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "timeBrushParameterName": "SelectedTimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "categoricalbar"
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "60",
      "name": "Total Events by User over Time"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SymantecEndpointProtection\n| where LogType == \"Agent Risk Logs\"\n| where CategorySet in ({RiskCategory}) or '*' in ({RiskCategory})\n| where RiskName in ({RiskNames}) or '*' in ({RiskNames})\n| where UserName in ({UserNames}) or '*' in ({UserNames})\n| where SrcIpAddr in ({IPAddress}) or '*' in ({IPAddress})\n| where SrcHostName in ({Hostnames}) or '*' in ({Hostnames})\n| summarize Total = count() by UserName\n| top 10 by Total",
        "size": 0,
        "showAnalytics": true,
        "title": "Top 10 User Names",
        "timeContext": {
          "durationMs": 43200000
        },
        "timeContextFromParameter": "TimeRange",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              },
              "tooltipFormat": {}
            }
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "TabName",
        "comparison": "isEqualTo",
        "value": "RiskEvents"
      },
      "customWidth": "40",
      "name": "Top 10 User Names"
    }
  ],
  "fallbackResourceIds": [
    "/subscriptions/7ac4b7c7-65f2-46c7-87bb-ca6ac8e5dbef/resourcegroups/socaas-rg/providers/microsoft.operationalinsights/workspaces/toncoso"
  ],
  "fromTemplateId": "sentinel-SymantecEndpointProtection",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}