{
  "version": "Notebook/1.0",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json",
  "fromTemplateId": "sentinel-StratoSecure-SOC",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## StratoSecure — SOC Code Context\n\nCorrelate code-level findings with active Sentinel incidents. Identify affected applications and OWASP risk categories."
      },
      "name": "header"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "timeRange",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "value": {"durationMs": 604800000}
          },
          {
            "id": "severity",
            "version": "KqlParameterItem/1.0",
            "name": "Severity",
            "label": "Severity Filter",
            "type": 2,
            "query": "datatable(Severity: string) ['Critical', 'High', 'Medium', 'Low', 'All']",
            "value": "All",
            "queryType": 0
          }
        ]
      },
      "name": "parameters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_Findings_CL\n| where TimeGenerated {TimeRange}\n| where '{Severity}' == 'All' or Severity == '{Severity}'\n| project TimeGenerated, FindingId, Title, Severity, ApplicationId, FilePath, OwaspCategory, FixStatus\n| order by TimeGenerated desc\n| take 100",
        "size": 1,
        "title": "Recent Findings",
        "queryType": 0,
        "visualization": "table"
      },
      "name": "recentFindings"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "StratoSecure_Findings_CL\n| where TimeGenerated {TimeRange}\n| summarize count() by OwaspCategory\n| where isnotempty(OwaspCategory)\n| order by count_ desc\n| take 10",
        "size": 1,
        "title": "Top OWASP Categories",
        "queryType": 0,
        "visualization": "barchart"
      },
      "name": "owaspCategories"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SecurityIncident\n| where TimeGenerated {TimeRange}\n| where Status != 'Closed'\n| project IncidentNumber, Title, Severity, Status, TimeGenerated\n| order by TimeGenerated desc\n| take 20",
        "size": 1,
        "title": "Active Sentinel Incidents",
        "queryType": 0,
        "visualization": "table"
      },
      "name": "activeIncidents"
    }
  ],
  "fallbackResourceIds": []
}