{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "bea257bd-19ed-4afd-b2db-817eb5aced6f", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Application Overview", "subTarget": "tab1", "style": "link" }, { "id": "61b82b1b-1290-4757-b181-a3fa015b5aae", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Alert Overview", "subTarget": "tab2", "style": "link" }, { "id": "d33934aa-be63-4925-826c-54dcc185e4c9", "cellValue": "view", "linkTarget": "parameter", "linkLabel": "Web Transactions Overview", "subTarget": "tab3", "style": "link" } ] }, "name": "links - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "66dab7e6-5f19-48d6-b11c-5a94f84dafdb", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "TimeRange", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 11", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication\n| where isnotempty(App)\n| summarize arg_max(TimeGenerated,*) by Id\n| summarize Count = count() by Application = App\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Top Applications By Usage", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Application", "exportParameterName": "ApplicationName1", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "$gen_bar_Count_1", "sortOrder": 2 } ] }, "sortBy": [ { "itemKey": "$gen_bar_Count_1", "sortOrder": 2 } ] }, "customWidth": "50", "name": "Top Applications By Usage", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where App == '{ApplicationName1}'\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by User\r\n| top 50 by Count", "size": 0, "showAnalytics": true, "title": "Top 50 Users Of {ApplicationName1}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "ApplicationName1", "comparison": "isNotEqualTo", "value": "" }, "name": "Top 50 Users Of Application : {ApplicationName1}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(App)\r\n| summarize arg_max(TimeGenerated,*) by App\r\n| sort by CCI desc\r\n| project Application = App, ['CCI SCORE'] = CCI", "size": 0, "showAnalytics": true, "title": "Top Applications By CCI Score", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Application", "exportParameterName": "ApplicationName2", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "CCI SCORE", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "Top Applications By CCI Score", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where App == '{ApplicationName2}'\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by User\r\n| top 50 by Count", "size": 0, "showAnalytics": true, "title": "Top 50 Users Of {ApplicationName2}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "conditionalVisibility": { "parameterName": "ApplicationName2", "comparison": "isNotEqualTo" }, "name": "Top 50 Users Of {ApplicationName2}", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on a row in the above 'Top Applications By Usage' and 'Top Applications By CCI score' grid to view more details_\r\n" }, "name": "text - 24" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(AppCategory)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by AppCategory\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Top Categories", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "CategoryName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "gridSettings": { "rowLimit": 10000, "filter": true }, "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "Top Categories", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(Browser)\r\n| summarize arg_max(TimeGenerated,*) by Id \r\n| summarize Count = count() by Browser\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Browser Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "BrowserName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "Browser Breakdown", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top Categories' pie chart to view more details_" }, "customWidth": "50", "name": "text - 25" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Browser Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where AppCategory == '{CategoryName}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For {CategoryName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CategoryName", "comparison": "isNotEqualTo" }, "name": "Applications Data For Category : {CategoryName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where Browser == '{BrowserName}'\r\n| summarize arg_max(TimeGenerated,*) by Id ", "size": 0, "showAnalytics": true, "title": "Application Details For {BrowserName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "BrowserName", "comparison": "isNotEqualTo" }, "name": "Application Details For {BrowserName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication\r\n| where isnotempty(DeviceClassification)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by DeviceClassification\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Device Classification", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "DeviceClassificationName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "", "label": "" } ] } }, "customWidth": "50", "name": "query - 8", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(CCL)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by CCL\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Cloud Confidence Level Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "CCL", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Device Classification' pie chart to view more details_" }, "customWidth": "50", "name": "text - 27" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Cloud Confidence Level Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 28" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication\r\n| where DeviceClassification == '{DeviceClassificationName}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For {DeviceClassificationName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DeviceClassificationName", "comparison": "isNotEqualTo" }, "name": "Application Details For {DeviceClassificationName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where CCL == \"{CCL}\"\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For Cloud Confidence Level {CCL}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CCL", "comparison": "isNotEqualTo" }, "name": "Application Details For Cloud Confidence Level {CCL}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(Device)\r\n| extend Device = iff(Device == \"Other\", \"Other (value in Data)\", Device)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Device\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Device Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "DeviceName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 11, "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Other", "label": "Other (grouped other values)" } ] } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(Activity)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Activity\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top 10 Application Activities", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "ActivityName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "createOtherGroup": 11 } }, "customWidth": "50", "name": "query - 7", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Device Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 29" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top 10 Application Activities' bar chart to view more details_" }, "customWidth": "50", "name": "text - 30" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication\r\n| where Device == (case(\"{DeviceName}\"==\"Other\",\"Other(Grouped Value)\",\"{DeviceName}\"==\"Other (value in Data)\",\"Other\",\"{DeviceName}\"))\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For Device {DeviceName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DeviceName", "comparison": "isNotEqualTo" }, "name": "Application Details For Device {DeviceName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where Activity == '{ActivityName}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For Activity {ActivityName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "ActivityName", "comparison": "isNotEqualTo" }, "name": "Application Details For Activity {ActivityName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(User)and isnotempty(AccessMethod)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by User, ['Access Method'] = AccessMethod\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Top Users By Access Method", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "User", "parameterName": "UserName", "parameterType": 1, "defaultValue": "none" }, { "fieldName": "Access Method", "parameterName": "AccessMethod", "parameterType": 1, "defaultValue": "none" } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "100", "name": "Top Users By Access Method", "styleSettings": { "margin": "5px", "maxWidth": "100%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top Users By Access Method' grid to view more details_" }, "name": "text - 31" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where User == '{UserName}'\r\n and AccessMethod == '{AccessMethod}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For User {UserName} And Access Method {AccessMethod}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "100", "conditionalVisibilities": [ { "parameterName": "UserName", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "AccessMethod", "comparison": "isNotEqualTo", "value": "none" } ], "name": "query - 24", "styleSettings": { "margin": "5px", "maxWidth": "100%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(User) and isnotempty( App)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize ['Total Client Bytes'] = sum(todecimal(ClientBytes)),['Total Server Bytes'] =sum(todecimal(ServerBytes)) by User,Application = App\r\n ", "size": 0, "showAnalytics": true, "title": "Bytes Transferred", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Client Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } }, { "columnMatch": "Total Server Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 10", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(OS)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by OS\r\n| sort by Count desc\r\n", "size": 0, "showAnalytics": true, "title": "OS Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "OS", "exportParameterName": "os", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "OS Breakdown", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where isnotempty(App) and isnotempty(Category)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Application = App, Category\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Applications Accessed (w/App Category)", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Category", "parameterName": "category", "defaultValue": "none" }, { "fieldName": "Application", "parameterName": "app", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "Applications Accessed (w/App Category)", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'OS Breakdown' grid to view more details_" }, "customWidth": "50", "name": "text - 32" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Applications Accessed (w/App Category)' grid to view more details_" }, "customWidth": "50", "name": "text - 33" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication\r\n| where OS == '{os}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For {os}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "100", "conditionalVisibility": { "parameterName": "os", "comparison": "isNotEqualTo", "value": "" }, "name": "Application Details For {os}", "styleSettings": { "margin": "5px", "maxWidth": "100%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "EventsApplication \r\n| where App == '{app}'\r\n and Category == '{category}'\r\n| summarize arg_max(TimeGenerated,*) by Id", "size": 0, "showAnalytics": true, "title": "Application Details For Application {app} And Category {category}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "category", "comparison": "isNotEqualTo", "value": "none" }, { "parameterName": "app", "comparison": "isNotEqualTo", "value": "none" } ], "name": "Application Details For Application {app} And Category {category}", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "tab1" }, "name": "group - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "66dab7e6-5f19-48d6-b11c-5a94f84dafdb", "version": "KqlParameterItem/1.0", "name": "TimeRange", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 }, "label": "Time Range" }, { "id": "2f85800e-e576-4669-b72d-2527981dc15d", "version": "KqlParameterItem/1.0", "name": "TypeOfAlert", "label": "Type Of Alert", "type": 2, "description": "Select Alert Type to visualize data related to specific type of alert", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where isnotempty(AlertType)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| distinct tolower(AlertType)", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "doNotRunWhenHidden": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "TimeRange", "comparison": "isNotEqualTo", "value": "None" }, "name": "parameters - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\n| where isnotempty(DlpFile)\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\n| summarize arg_max(TimeGenerated,*) by Id\n| summarize Count = count() by DlpFile\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Top 10 File Matches For DLP", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| where isnotempty(App)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by App\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Top 10 Applications Triggering Alerts", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "AppName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "app_s", "formatter": 1 }, "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "app_s", "formatter": 1 }, "centerContent": { "columnMatch": "count_", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Other", "label": "Others" }, { "seriesName": "Other", "label": "Other Data" } ] }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "count_", "sizeAggregation": "Sum", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "count_", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 12" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top 10 Applications Triggering Alerts' pie chart to view more details_" }, "customWidth": "50", "name": "text - 13" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where App == \"{AppName}\"\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Alert Details For {AppName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "AppName", "comparison": "isNotEqualTo" }, "name": "query - 8", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by tolower(AlertType)\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Alert Type Breakdown", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true, "seriesLabelSettings": [ { "seriesName": "Other", "label": "other", "color": "gray" } ] } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| where isnotempty(DlpProfile)\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by DlpProfile\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Top 10 DLP Profiles", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where isnotempty(DlpRule) and isnotempty(DlpRuleSeverity)\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Rule = DlpRule, Severity = DlpRuleSeverity\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top 10 DLP Rules", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Rule", "parameterName": "DlpRuleSelected", "parameterType": 1 }, { "fieldName": "Severity", "parameterName": "DlpSeveritySelected", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true } }, "customWidth": "33.34", "name": "query - 6", "styleSettings": { "margin": "3px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where isnotempty(Policy)\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Policy\r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top 10 Policy Hits", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Policy", "exportParameterName": "PolicyName", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true } }, "customWidth": "33.33", "showPin": false, "name": "query - 7", "styleSettings": { "margin": "3px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where isnotempty(AccessMethod) and isnotempty(Policy)\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| summarize Count = count() by Policy,Method = AccessMethod\r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Policy Alerts by Access Method", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "Policy", "parameterName": "PolicyName2" }, { "fieldName": "Method", "parameterName": "AccessMethodName", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "filter": true } }, "customWidth": "33.33", "name": "query - 11", "styleSettings": { "margin": "3px", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top 10 DLP Rules' grid to view more details_" }, "customWidth": "33.34", "name": "text - 16" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top 10 Policy Hits' grid to view more details_" }, "customWidth": "33.33", "name": "text - 17" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Policy Alerts by Access Method' grid to view more details_" }, "customWidth": "33.33", "name": "text - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| where DlpRule =~ \"{DlpRuleSelected}\" and DlpRuleSeverity =~ '{DlpSeveritySelected}'\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Alert Details For Dlp Rule {DlpRuleSelected} and Severity {DlpSeveritySelected}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DlpRuleSelected", "comparison": "isNotEqualTo" }, "name": "Alert Details For Dlp Rule {DlpRuleSelected} and Severity {DlpSeveritySelected}", "styleSettings": { "margin": "5", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| where Policy =~ \"{PolicyName}\"\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Alert Details For {PolicyName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "PolicyName", "comparison": "isNotEqualTo" }, "name": "query - 9", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "union isfuzzy=true AlertsDLP,AlertsCtep,AlertsCompromisedCredential,AlertsMalsite,AlertsMalware,AlertsPolicy,AlertsQuarantine,AlertsRemediation,AlertsSecurityAssessment,AlertsUba\r\n| where ('{TypeOfAlert:escapejson}' == '*' or AlertType in~ ({TypeOfAlert}))\r\n| where Policy =~ \"{PolicyName2}\" and AccessMethod =~ '{AccessMethodName}'\r\n| summarize arg_max(TimeGenerated,*) by Id\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Alert Details For Policy {PolicyName2} and Access Method {AccessMethodName}", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "PolicyName2", "comparison": "isNotEqualTo" }, "name": "query - 11", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "tab2" }, "name": "group - 11" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e9fc5159-d3fe-4011-8dd5-7ee37332612c", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| top 1 by TimeGenerated\r\n| extend DateTime = todatetime(strcat(Date,\" \", Time))\r\n| extend ['Time Difference'] = datetime_diff('Minute',TimeGenerated,DateTime)\r\n| project ['Time Difference']\r\n| extend ['Time Difference'] = strcat(['Time Difference'],' Minutes')\r\n", "size": 3, "showAnalytics": true, "title": "Latency of last ingested event (in minutes)", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "card", "gridSettings": { "rowLimit": 10000 }, "tileSettings": { "showBorder": false }, "textSettings": { "style": "bignumber" } }, "name": "query - 6", "styleSettings": { "margin": "5px", "padding": "30px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientBrowser != '-' and isnotempty(ClientBrowser)\r\n| summarize Count = count() by ClientBrowser\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Browser Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Browser", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientDeviceType != '-' and isnotempty(ClientDeviceType)\r\n| summarize Count = count() by ClientDeviceType\r\n| sort by Count desc", "size": 3, "showAnalytics": true, "title": "Device Breakdown", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "DeviceName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 8", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Browser Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 13" }, { "type": 1, "content": { "json": "💡 _Click on the above 'Device Breakdown' pie chart to view more details_" }, "customWidth": "50", "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientBrowser == '{Browser}'\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {Browser}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Browser", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {Browser}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientDeviceType == '{DeviceName}'\r\n| sort by TimeGenerated desc\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {DeviceName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DeviceName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {DeviceName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientUsername != '-' and ClientMethod != '-' and isnotempty(ClientUsername) and isnotempty(ClientMethod)\r\n| summarize Count = count() by ['User Name'] = ClientUsername, Method = ClientMethod \r\n| sort by Count desc", "size": 0, "showAnalytics": true, "title": "Top Users By Access Method", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "User Name", "parameterName": "UserName", "parameterType": 1 }, { "fieldName": "Method", "parameterName": "Method", "parameterType": 1 } ], "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 10", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientCloudApp !='-' and ClientUsername != '-' and isnotempty(ClientCloudApp) and isnotempty(ClientUsername)\r\n| summarize ['Total Client Bytes'] = sum(todecimal(ClientBytes)), ['Total Server Bytes'] = sum(todecimal(ServerBytes)) by Application = ClientCloudApp,['User Name'] = ClientUsername\r\n| sort by ['Total Client Bytes'] desc", "size": 0, "showAnalytics": true, "title": "Bytes Transferred", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Total Client Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } }, { "columnMatch": "Total Server Bytes", "formatter": 4, "formatOptions": { "min": 0, "palette": "blue" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Application", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Application", "sortOrder": 1 } ] }, "customWidth": "50", "name": "query - 11", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 _Click on the above 'Top Users By Access Method' grid to view more details_" }, "customWidth": "50", "name": "text - 15" }, { "type": 1, "content": { "json": "" }, "customWidth": "50", "name": "text - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientUsername == '{UserName}' and ClientMethod == '{Method}'\r\n| sort by TimeGenerated desc", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For User {UserName} and Method {Method}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibilities": [ { "parameterName": "UserName", "comparison": "isNotEqualTo" }, { "parameterName": "Method", "comparison": "isNotEqualTo" } ], "name": "Web Transactions Details For User {UserName} and Method {Method}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where Site != '-' and isnotempty(Site)\r\n| summarize Count = count() by Site\r\n| top 10 by Count", "size": 3, "showAnalytics": true, "title": "Top 10 Sites", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "SiteName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 12", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientHost != '-' and isnotempty(ClientHost)\r\n| summarize Count = count() by ClientHost\r\n| top 10 by Count\r\n", "size": 3, "showAnalytics": true, "title": "Top 10 Hosts", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "HostName", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "50", "name": "query - 13", "styleSettings": { "margin": "5px", "padding": "50px", "maxWidth": "50%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 Click on the above 'Top 10 Sites' pie chart to view more details" }, "customWidth": "50", "name": "text - 17" }, { "type": 1, "content": { "json": "💡 Click on the above 'Top 10 Hosts' pie chart to view more details" }, "customWidth": "50", "name": "text - 18" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where Site == '{SiteName}'\r\n| sort by TimeGenerated desc\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {SiteName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "SiteName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {SiteName}", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "NetskopeWebTransactions\r\n| where ClientHost == '{HostName}'\r\n| sort by TimeGenerated desc\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Web Transactions Details For {HostName}", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "HostName", "comparison": "isNotEqualTo" }, "name": "Web Transactions Details For {HostName}", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "view", "comparison": "isEqualTo", "value": "tab3" }, "name": "Web Transactions Overview" } ], "fromTemplateId": "sentinel-NetskopeDashboard", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }