{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## INCIDENTS FROM ARMORBLOX"
      },
      "name": "text - 0",
      "styleSettings": {
        "margin": "5px",
        "padding": "5px"
      }
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "57bfc245-223e-4ef2-892a-35f9b3049ee0",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "description": "INCIDENTS FROM SELECTED TIME RANGE",
            "isRequired": true,
            "value": {
              "durationMs": 259200000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 1"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Armorblox_CL\r\n| sort by TimeGenerated desc\r\n| where TimeGenerated {TimeRange}\r\n| summarize count() by priority_s\r\n",
        "size": 1,
        "timeContext": {
          "durationMs": 259200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "chartSettings": {
          "yAxis": [
            "count_"
          ],
          "showLegend": true
        }
      },
      "customWidth": "50",
      "name": "query - 3",
      "styleSettings": {
        "margin": "5",
        "padding": "5",
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Armorblox_CL\r\n| sort by TimeGenerated desc\r\n| where TimeGenerated {TimeRange}\r\n| summarize count() by incident_type_s\r\n",
        "size": 1,
        "timeContext": {
          "durationMs": 259200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - 4",
      "styleSettings": {
        "margin": "5",
        "padding": "5",
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Armorblox_CL\r\n| sort by TimeGenerated desc\r\n| where TimeGenerated {TimeRange} and incident_type_s=='THREAT_INCIDENT_TYPE'\r\n| extend policy = substring(policy_names_s, 1, strlen(policy_names_s)-2)\r\n| summarize count() by policy\r\n",
        "size": 1,
        "timeContext": {
          "durationMs": 259200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "policy_names_s",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "customWidth": "50",
      "name": "query - 6",
      "styleSettings": {
        "margin": "5",
        "padding": "5",
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Armorblox_CL\r\n| sort by TimeGenerated desc\r\n| where TimeGenerated {TimeRange} and incident_type_s=='DLP_INCIDENT_TYPE'\r\n| extend policy = substring(policy_names_s, 1, strlen(policy_names_s)-2)\r\n| summarize count() by policy\r\n",
        "size": 1,
        "timeContext": {
          "durationMs": 259200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - 7",
      "styleSettings": {
        "margin": "5",
        "padding": "5",
        "showBorder": true
      }
    },
    {
      "type": 1,
      "content": {
        "json": "## INCIDENTS"
      },
      "name": "text - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "Armorblox_CL\r\n| project TimeGenerated, date_t, id_s, priority_s, policy_names_s, title_s, remediation_actions_s, resolution_state_s, research_status_s\r\n| project-rename OccurredDate=date_t, IncidentId=id_s, Priority=priority_s, Subject=title_s, RemediationAction=remediation_actions_s, ResolutionState=resolution_state_s, ResearchStatus=research_status_s\r\n| where TimeGenerated {TimeRange}\r\n| sort by TimeGenerated desc\r\n",
        "size": 0,
        "timeContext": {
          "durationMs": 259200000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 2",
      "styleSettings": {
        "margin": "5",
        "padding": "5",
        "showBorder": true
      }
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-ArmorbloxOverview",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}