{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "228d6050-af03-4f13-8075-8a19c58ce548",
            "version": "KqlParameterItem/1.0",
            "name": "Date",
            "type": 4,
            "isGlobal": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 4"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| summarize count() by ThreatLevel\r\n| order by count_",
              "size": 2,
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "ThreatLevel",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "customWidth": "50",
            "name": "query - 6"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| project MyJson = parse_json(Assets)\r\n| mvexpand MyJson\r\n| summarize count() by tostring(MyJson)\r\n| top 10 by count_",
              "size": 2,
              "title": "Top 10 Matched Assets",
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts",
              "size": 0,
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart",
              "chartSettings": {
                "showMetrics": false,
                "showDataPoints": true
              }
            },
            "name": "item-1-timeline"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| where ThreatActor != \"\"\r\n| summarize count() by ThreatActor \r\n| top 10 by count_",
              "size": 2,
              "title": "Top 10 threat actors",
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "item-2-threat-actors"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| summarize count() by ThreatLevel \r\n| top 10 by count_",
              "size": 2,
              "title": "Threat Level",
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "item-3-theat-level"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| summarize count() by ThreatSource \r\n| top 10 by count_",
              "size": 2,
              "title": "Top 10 Sources",
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "item-4-threat-source"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "CyberSixgill_Alerts\r\n| project MyJson = parse_json(Threats)\r\n| mvexpand MyJson\r\n| summarize count() by tostring(MyJson)",
              "size": 2,
              "title": "Alerts by Type",
              "timeContextFromParameter": "Date",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "50",
            "name": "query - 2"
          }
        ]
      },
      "name": "group - 5"
    }
  ],
  "fallbackResourceIds": [
    ""
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-ActionableAlertsDashboard",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}