{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Microsoft Copilot Activity Monitoring\n---\n\nThis workbook provides comprehensive monitoring and analysis of Microsoft Copilot activities including user interactions, plugin management, and security events."
      },
      "name": "text - workbook-description"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "e8f9f4db-84ff-4b8a-9b7c-6c8a5d4e3f2a",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 7776000000
            }
          },
          {
            "id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e",
            "version": "KqlParameterItem/1.0",
            "name": "RecordType",
            "label": "Record Type",
            "type": 2,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| distinct RecordType\n| order by RecordType asc",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          },
          {
            "id": "c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f",
            "version": "KqlParameterItem/1.0",
            "name": "AppIdentity",
            "label": "App Identity",
            "type": 2,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where isnotempty(AppIdentity)\n| distinct AppIdentity\n| order by AppIdentity asc",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          },
          {
            "id": "d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a",
            "version": "KqlParameterItem/1.0",
            "name": "ActorName",
            "label": "User (Actor)",
            "type": 2,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| distinct ActorName\n| order by ActorName asc",
            "typeSettings": {
              "additionalResourceOptions": [
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 0
            },
            "timeContextFromParameter": "TimeRange",
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces",
            "value": [
              "value::all"
            ]
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - filters"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| summarize count() by RecordType",
        "size": 4,
        "title": "All Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "RecordType",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "count_",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "UniqueUsers",
            "formatter": 1
          },
          "showBorder": true
        }
      },
      "customWidth": "100",
      "name": "query - summary-metrics",
      "styleSettings": {
        "margin": "10px",
        "padding": "10px"
      }
    },
    {
      "type": 1,
      "content": {
        "json": "### 📊 Activity Overview"
      },
      "name": "text - activity-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain}), RecordType\n| render timechart",
        "size": 0,
        "title": "Activity Timeline by Record Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "query - activity-timeline"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| summarize Count = count() by RecordType\n| order by Count desc\n| render piechart",
        "size": 0,
        "title": "Activity Distribution by Type",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - activity-distribution"
    },
    {
      "type": 1,
      "content": {
        "json": "### 👥 User Activity Analysis"
      },
      "name": "text - user-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| summarize TotalActivities = count(),\n            Interactions = countif(RecordType == \"CopilotInteraction\"),\n            PluginActions = countif(RecordType in (\"CreateCopilotPlugin\", \"EnableCopilotPlugin\", \"DisableCopilotPlugin\")),\n            LastActivity = max(TimeGenerated),\n            FirstActivity = min(TimeGenerated)\n            by ActorName, ActorUserType\n| extend DaysSinceFirstActivity = datetime_diff('day', now(), FirstActivity)\n| order by TotalActivities desc\n| project ActorName, ActorUserType, TotalActivities, Interactions, PluginActions, LastActivity, DaysSinceFirstActivity",
        "size": 0,
        "title": "Top Users by Activity",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TotalActivities",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "Interactions",
              "formatter": 8,
              "formatOptions": {
                "palette": "green"
              }
            },
            {
              "columnMatch": "PluginActions",
              "formatter": 8,
              "formatOptions": {
                "palette": "orange"
              }
            },
            {
              "columnMatch": "LastActivity",
              "formatter": 6
            }
          ],
          "filter": true
        }
      },
      "name": "query - top-users"
    },
    {
      "type": 1,
      "content": {
        "json": "### 🔌 Plugin Management"
      },
      "name": "text - plugin-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where RecordType in (\"CreateCopilotPlugin\", \"EnableCopilotPlugin\", \"DisableCopilotPlugin\")\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| extend LLMData = parse_json(LLMEventData)\n| extend WorkspaceName = tostring(LLMData.Workspace.Name)\n| extend Resource = tostring(LLMData.Resource[0].Property)\n| extend OriginalValue = tostring(LLMData.Resource[0].OriginalValue)\n| extend NewValue = tostring(LLMData.Resource[0].NewValue)\n| project TimeGenerated, ActorName, RecordType, AppIdentity, WorkspaceName, Resource, OriginalValue, NewValue\n| order by TimeGenerated desc",
        "size": 0,
        "title": "Plugin Management Events",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "RecordType",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {
                    "operator": "==",
                    "thresholdValue": "CreateCopilotPlugin",
                    "representation": "blue",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "EnableCopilotPlugin",
                    "representation": "green",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "DisableCopilotPlugin",
                    "representation": "orange",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "gray",
                    "text": "{0}{1}"
                  }
                ]
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "100",
      "name": "query - plugin-events"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where RecordType in (\"CreateCopilotPlugin\", \"EnableCopilotPlugin\", \"DisableCopilotPlugin\")\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| summarize Count = count() by bin(TimeGenerated, {TimeRange:grain}), RecordType\n| render timechart",
        "size": 0,
        "title": "Plugin Management Timeline",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - plugin-timeline"
    },
    {
      "type": 1,
      "content": {
        "json": "### 🤖 AI Model Usage"
      },
      "name": "text - ai-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where RecordType == \"CopilotInteraction\"\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| where isnotempty(AIModelName)\n| summarize Interactions = count(),\n            UniqueUsers = dcount(ActorName),\n            LastUsed = max(TimeGenerated)\n            by AIModelName, AppHost\n| order by Interactions desc",
        "size": 0,
        "title": "AI Model Usage Statistics",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Interactions",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "UniqueUsers",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ],
          "filter": true
        }
      },
      "customWidth": "50",
      "name": "query - ai-model-usage"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where RecordType == \"CopilotInteraction\"\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| where isnotempty(AppHost)\n| summarize Count = count() by AppHost\n| order by Count desc\n| render piechart",
        "size": 0,
        "title": "Usage by Application Host",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "query - app-host-distribution"
    },
    {
      "type": 1,
      "content": {
        "json": "### 🔒 Security Insights"
      },
      "name": "text - security-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where RecordType == \"CopilotInteraction\"\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| extend LLMData = parse_json(LLMEventData)\n| mv-expand Message = LLMData.Messages\n| extend JailbreakDetected = tobool(Message.JailbreakDetected)\n| where JailbreakDetected == true\n| project TimeGenerated, ActorName, AppHost, AIModelName, MessageId = tostring(Message.Id), IsPrompt = tobool(Message.isPrompt)\n| order by TimeGenerated desc",
        "size": 0,
        "title": "⚠️ Jailbreak Detection Events",
        "noDataMessage": "No jailbreak attempts detected in the selected time range",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TimeGenerated",
              "formatter": 6,
              "formatOptions": {
                "customColumnWidthSetting": "20ch"
              }
            }
          ],
          "rowLimit": 100,
          "filter": true
        }
      },
      "name": "query - jailbreak-detection"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| where isnotempty(SrcIpAddr)\n| summarize Events = count(), \n            UniqueUsers = dcount(ActorName),\n            RecordTypes = make_set(RecordType),\n            LastSeen = max(TimeGenerated)\n            by SrcIpAddr\n| order by Events desc\n| take 20",
        "size": 0,
        "title": "Top Source IP Addresses",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Events",
              "formatter": 8,
              "formatOptions": {
                "palette": "blue"
              }
            },
            {
              "columnMatch": "UniqueUsers",
              "formatter": 4,
              "formatOptions": {
                "palette": "green"
              }
            }
          ],
          "filter": true
        }
      },
      "name": "query - source-ips"
    },
    {
      "type": 1,
      "content": {
        "json": "### 📋 Detailed Activity Log"
      },
      "name": "text - detailed-header"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "CopilotActivity\n| where TimeGenerated {TimeRange}\n| where '*' in ({RecordType}) or RecordType in ({RecordType})\n| where '*' in ({AppIdentity}) or AppIdentity in ({AppIdentity}) or isempty(AppIdentity)\n| where '*' in ({ActorName}) or ActorName in ({ActorName})\n| project TimeGenerated, \n          RecordType, \n          ActorName, \n          ActorUserType,\n          AppHost,\n          AppIdentity,\n          AIModelName,\n          SrcIpAddr,\n          Workload,\n          LLMEventData\n| order by TimeGenerated desc\n| take 500",
        "size": 0,
        "title": "Recent Copilot Activities (Last 500 Events)",
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "TimeGenerated",
              "formatter": 6
            },
            {
              "columnMatch": "RecordType",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "colors",
                "thresholdsGrid": [
                  {
                    "operator": "==",
                    "thresholdValue": "CopilotInteraction",
                    "representation": "blue",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "CreateCopilotPlugin",
                    "representation": "turquoise",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "EnableCopilotPlugin",
                    "representation": "green",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "==",
                    "thresholdValue": "DisableCopilotPlugin",
                    "representation": "orange",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "gray",
                    "text": "{0}{1}"
                  }
                ]
              }
            },
            {
              "columnMatch": "LLMEventData",
              "formatter": 7,
              "formatOptions": {
                "linkTarget": "CellDetails",
                "linkLabel": "View Details"
              }
            }
          ],
          "filter": true,
          "hierarchySettings": {
            "treeType": 1,
            "groupBy": [
              "RecordType"
            ]
          }
        }
      },
      "name": "query - detailed-log"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-MicrosoftCopilotActivityMonitoring",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}