{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "**NOTE**: This data connector depends on a parser based on Kusto Function **OracleDatabaseAuditEvent** to work as expected.  [Follow steps to get this Kusto Function](https://aka.ms/sentinel-OracleDatabaseAudit-parser)",
          "style": "info"
        },
        "name": "text - 9"
      },
      {
        "type": 9,
        "content": {
          "version": "KqlParameterItem/1.0",
          "parameters": [
            {
              "id": "88aa96e3-fc48-4b04-836e-fc2ec8ebf37f",
              "version": "KqlParameterItem/1.0",
              "name": "TimeRange",
              "label": " Time Range",
              "type": 4,
              "value": {
                "durationMs": 2592000000
              },
              "typeSettings": {
                "selectableValues": [
                  {
                    "durationMs": 300000
                  },
                  {
                    "durationMs": 3600000
                  },
                  {
                    "durationMs": 43200000
                  },
                  {
                    "durationMs": 86400000
                  },
                  {
                    "durationMs": 259200000
                  },
                  {
                    "durationMs": 604800000
                  },
                  {
                    "durationMs": 2592000000
                  },
                  {
                    "durationMs": 7776000000
                  }
                ]
              },
              "timeContext": {
                "durationMs": 86400000
              }
            }
          ],
          "style": "pills",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "parameters - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};",
          "size": 0,
          "title": "Events over time",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "timechart"
        },
        "customWidth": "70",
        "name": "query - 9"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where isnotempty(DbAction)\r\n| summarize TotalEvents = count() by DbAction",
          "size": 3,
          "title": "Top Database Actions",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart",
          "tileSettings": {
            "titleContent": {
              "columnMatch": "EventSeverity",
              "formatter": 1,
              "numberFormat": {
                "unit": 0,
                "options": {
                  "style": "decimal"
                }
              }
            },
            "leftContent": {
              "columnMatch": "TotalEvents",
              "formatter": 12,
              "formatOptions": {
                "palette": "auto"
              }
            },
            "showBorder": true,
            "rowLimit": 7,
            "size": "auto"
          },
          "graphSettings": {
            "type": 0,
            "topContent": {
              "columnMatch": "EventSeverity",
              "formatter": 1
            },
            "centerContent": {
              "columnMatch": "TotalEvents",
              "formatter": 1,
              "numberFormat": {
                "unit": 17,
                "options": {
                  "maximumSignificantDigits": 3,
                  "maximumFractionDigits": 2
                }
              }
            }
          }
        },
        "customWidth": "30",
        "name": "query - 3"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where isnotempty(DstUserName)\r\n| summarize TotalEvents = count() by DstUserName\r\n| order by TotalEvents\r\n| take 10",
          "size": 3,
          "title": "Database Users Activity (Events)",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart",
          "chartSettings": {}
        },
        "customWidth": "30",
        "name": "query - 5"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where isnotempty(SrcUserName)\r\n| summarize TotalEvents = count() by SrcUserName\r\n",
          "size": 3,
          "title": "Source Users Activity (Events)",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "piechart",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "TotalEvents",
                "formatter": 8,
                "formatOptions": {
                  "palette": "blueGreen"
                }
              },
              {
                "columnMatch": "Trend",
                "formatter": 10,
                "formatOptions": {
                  "palette": "turquoise"
                }
              }
            ],
            "rowLimit": 10,
            "labelSettings": [
              {
                "columnId": "TotalEvents",
                "label": "Total Events"
              },
              {
                "columnId": "Trend"
              }
            ]
          }
        },
        "customWidth": "31",
        "name": "query - 6"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where isnotempty(SrcDvcHostname)\r\n| summarize TotalEvents = count() by SrcDvcHostname\r\n| join kind = inner (OracleDatabaseAuditEvent\r\n | where isnotempty(SrcDvcHostname)\r\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SrcDvcHostname)\r\n on SrcDvcHostname\r\n| project SrcDvcHostname, TotalEvents, Trend\r\n| order by TotalEvents\r\n| top 10 by TotalEvents",
          "size": 3,
          "title": "Top Source Hosts",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "formatters": [
              {
                "columnMatch": "TotalEvents",
                "formatter": 8,
                "formatOptions": {
                  "palette": "turquoise"
                }
              },
              {
                "columnMatch": "Trend",
                "formatter": 10,
                "formatOptions": {
                  "palette": "blue"
                }
              }
            ]
          },
          "tileSettings": {
            "showBorder": false,
            "titleContent": {
              "columnMatch": "SrcDvcHostname",
              "formatter": 1
            },
            "leftContent": {
              "columnMatch": "TotalEvents",
              "formatter": 12,
              "formatOptions": {
                "palette": "auto"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "maximumSignificantDigits": 3,
                  "maximumFractionDigits": 2
                }
              }
            }
          },
          "chartSettings": {}
        },
        "customWidth": "33",
        "name": "query - 7"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\n| where DbAction =~ 'SELECT'\n| extend TableName = replace(@'[,\\(\\)]', '', extract(@'(?i)SELECT(.*?)FROM\\s(.*?)\\s', 2, Action))\n| where isnotempty(TableName)\n| where TableName !in ('select', 'SELECT')\n| summarize count() by TableName\n| order by count_\n\n\n",
          "size": 0,
          "title": "Database Tables Queried",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "barchart",
          "tileSettings": {
            "titleContent": {
              "columnMatch": "EventCategory",
              "formatter": 1
            },
            "leftContent": {
              "columnMatch": "TotalEvents",
              "formatter": 12,
              "formatOptions": {
                "palette": "auto"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "maximumSignificantDigits": 3,
                  "maximumFractionDigits": 2
                }
              }
            },
            "secondaryContent": {
              "columnMatch": "Trend",
              "formatter": 9,
              "formatOptions": {
                "palette": "blue"
              }
            },
            "showBorder": false,
            "rowLimit": 10
          },
          "graphSettings": {
            "type": 0,
            "topContent": {
              "columnMatch": "TableName",
              "formatter": 1
            },
            "centerContent": {
              "columnMatch": "count_",
              "formatter": 1,
              "numberFormat": {
                "unit": 17,
                "options": {
                  "maximumSignificantDigits": 3,
                  "maximumFractionDigits": 2
                }
              }
            },
            "nodeIdField": "TableName",
            "sourceIdField": "TableName",
            "targetIdField": "count_",
            "graphOrientation": 3,
            "showOrientationToggles": false,
            "nodeSize": null,
            "staticNodeSize": 100,
            "colorSettings": null,
            "hivesMargin": 5
          },
          "chartSettings": {
            "xSettings": {
              "numberFormatSettings": {
                "unit": 0,
                "options": {
                  "style": "decimal",
                  "useGrouping": true
                }
              }
            }
          }
        },
        "name": "query - 2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where TimeGenerated > ago(30d)\r\n| order by TimeGenerated\r\n| where isnotempty(SrcUserName)\r\n| where isnotempty(DbAction)\r\n| summarize EventTime = max(TimeGenerated) by SrcUserName, DbAction\r\n| order by EventTime desc\r\n| join (OracleDatabaseAuditEvent\r\n    | where TimeGenerated > ago(30d)\r\n    | order by TimeGenerated\r\n    | where isnotempty(SrcUserName)\r\n    | where isnotempty(DbAction)\r\n    | summarize by SrcUserName) on SrcUserName\r\n| project EventTime, SrcUserName, DbAction\r\n\r\n",
          "size": 1,
          "title": "Latest User Actions",
          "timeContext": {
            "durationMs": 0
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "rowLimit": 100,
            "filter": true
          }
        },
        "customWidth": "50",
        "name": "query - 4"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "OracleDatabaseAuditEvent\r\n| where isnotempty(SrcUserName)\r\n| where isnotempty(Privilege)\r\n| summarize Privileges = makeset(Privilege) by SrcUserName",
          "size": 1,
          "title": "Users' Privileges",
          "timeContext": {
            "durationMs": 2592000000
          },
          "timeContextFromParameter": "TimeRange",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "table",
          "gridSettings": {
            "rowLimit": 100,
            "filter": true
          },
          "graphSettings": {
            "type": 0,
            "topContent": {},
            "leftContent": {
              "columnMatch": "SrcUserName"
            },
            "centerContent": {
              "columnMatch": "SrcUserName",
              "formatter": 1
            },
            "bottomContent": {
              "columnMatch": "set_Privilege",
              "formatter": 1
            },
            "nodeIdField": "set_Privilege",
            "sourceIdField": "SrcUserName",
            "targetIdField": "SrcUserName",
            "graphOrientation": 1,
            "showOrientationToggles": false,
            "nodeSize": null,
            "staticNodeSize": 100,
            "colorSettings": null,
            "groupByField": "SrcUserName",
            "hivesMargin": 5
          },
          "mapSettings": {
            "locInfo": "LatLong"
          }
        },
        "customWidth": "39",
        "name": "query - 8"
      }
    ],
    "fromTemplateId": "sentinel-OracleDatabaseAudit",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }