{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "\n# Theom Alert Statistics\n"
            },
            "customWidth": "50",
            "name": "text - 1"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "b75df6e9-5ef1-4d93-862c-02c2b020e0ad",
                  "version": "KqlParameterItem/1.0",
                  "name": "TimeRange",
                  "type": 4,
                  "description": "Select Time range",
                  "isRequired": true,
                  "isGlobal": true,
                  "typeSettings": {
                    "selectableValues": [
                      {
                        "durationMs": 1800000
                      },
                      {
                        "durationMs": 3600000
                      },
                      {
                        "durationMs": 14400000
                      },
                      {
                        "durationMs": 43200000
                      },
                      {
                        "durationMs": 86400000
                      },
                      {
                        "durationMs": 172800000
                      },
                      {
                        "durationMs": 259200000
                      },
                      {
                        "durationMs": 604800000
                      },
                      {
                        "durationMs": 1209600000
                      },
                      {
                        "durationMs": 2592000000
                      },
                      {
                        "durationMs": 5184000000
                      },
                      {
                        "durationMs": 7776000000
                      }
                    ]
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "value": {
                    "durationMs": 7776000000
                  }
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "50",
            "name": "parameters - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL\n| where type_s == \"Issue\" and TimeGenerated {TimeRange}\n| summarize Region = count() by customProps_Region_s\n",
              "size": 0,
              "title": "Alerts by Location",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "25",
            "name": "query - 10 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL\n| where type_s == \"Issue\" and TimeGenerated {TimeRange}\n| summarize Rules = count() by customProps_AssetType_s",
              "size": 0,
              "title": "Alerts by Asset Type",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "25",
            "name": "query - 10 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL\n| where type_s == \"Issue\" and TimeGenerated {TimeRange}\n| summarize Assets = count(), FinancialValue = sum(todouble(customProps_AssetNERValue_s)) by customProps_AssetType_s",
              "size": 0,
              "title": "Financial Value by Asset Type",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart"
            },
            "customWidth": "50",
            "name": "query - 10 - Copy - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL |\nmake-series Count = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
              "size": 0,
              "title": "Theom Alerts Over time",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart",
              "graphSettings": {
                "type": 0
              }
            },
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL | where priority_s == \"P1\" |make-series CritialAlerts = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
              "size": 0,
              "title": "Critical Risk Alerts",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "customWidth": "25",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL | where priority_s == \"P2\" |make-series HighAlerts = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
              "size": 0,
              "title": "High Risk Alerts",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "customWidth": "25",
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL | where priority_s == \"P3\" |make-series MediumAlerts = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
              "size": 0,
              "title": "Medium Risk Alerts",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "customWidth": "25",
            "name": "query - 1 - Copy - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL | where priority_s == \"P4\" |make-series LowAlerts = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}",
              "size": 0,
              "title": "Low Risk Alerts",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "customWidth": "25",
            "name": "query - 1 - Copy - Copy - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL\n| where type_s == \"Issue\" and TimeGenerated {TimeRange}\n| summarize Count = count() by SecurityRule = strcat(tostring(customProps_RuleId_s),\" \",tostring(split(summary_s,\"-\",0)))\n| sort by Count\n| take 10",
              "size": 0,
              "title": "Number of Alerts per Security Rule",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "sortBy": []
            },
            "name": "query - 10"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL \n| where priority_s == \"P1\" \n  and TimeGenerated {TimeRange}\n| sort by TimeGenerated desc\n| project AlertID = id_s,Asset = customProps_AssetName_s, TheomURL = deepLink_s,TimeGenerated\n| take 10",
              "size": 0,
              "title": "Latest 10 Critical Risk Alerts: Information",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "rowLimit": 10
              },
              "tileSettings": {
                "showBorder": false
              },
              "mapSettings": {
                "locInfo": "LatLong"
              }
            },
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL \n| where priority_s == \"P2\" \n  and TimeGenerated {TimeRange}\n| sort by TimeGenerated desc\n| project AlertID = id_s,Asset = customProps_AssetName_s, TheomURL = deepLink_s,TimeGenerated\n| take 10",
              "size": 0,
              "title": "Latest 10 High Risk Alerts: Information",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "rowLimit": 10
              },
              "tileSettings": {
                "showBorder": false
              },
              "mapSettings": {
                "locInfo": "LatLong"
              }
            },
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "TheomAlerts_CL \n| where priority_s == \"P3\" \n  and TimeGenerated {TimeRange}\n| sort by TimeGenerated desc\n| project AlertID = id_s,Asset = customProps_AssetName_s, TheomURL = deepLink_s,TimeGenerated\n| take 10",
              "size": 0,
              "title": "Latest 10 Medium Risk Alerts: Information",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "rowLimit": 10
              },
              "tileSettings": {
                "showBorder": false
              },
              "mapSettings": {
                "locInfo": "LatLong"
              }
            },
            "name": "query - 1 - Copy - Copy"
          }
        ]
      },
      "name": "group - 0"
    }
  ],
  "fromTemplateId": "sentinel-TheomWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}