{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "## Phishing Insights"
        },
        "name": "text - 6"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "DefendAuditData\r\n| where isnotempty(PhishType)\r\n| mv-expand todynamic(PhishType)\r\n| summarize EmailCount=count() by tostring(PhishType), LinksClicked\r\n| render columnchart",
          "size": 0,
          "title": "Number of Detected Phish Types in 48 hours",
          "timeContext": {
            "durationMs": 172800000
          },
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "visualization": "unstackedbar",
          "chartSettings": {
            "xAxis": "PhishType",
            "seriesLabelSettings": [
              {
                "seriesName": "LinksClicked",
                "color": "redDark"
              },
              {
                "seriesName": "EmailCount",
                "color": "blue"
              }
            ]
          }
        },
        "name": "query-2"
      },
      {
        "type": 3,
        "content": {
          "version": "KqlItem/1.0",
          "query": "DefendAuditData\r\n| where ThreatLevel == \"suspicious\" or ThreatLevel == \"dangerous\"\r\n| mv-expand todynamic(Attachments)\r\n| where Attachments.name matches regex @\"(?i)^.*\\.(doc|docx|docm|pdf|xls|xlsx|xlsm|html|zip)$(?-i)\"\r\n| extend path_parts = parse_path(tostring(Attachments.name))\r\n| where isnotempty(path_parts.Extension)\r\n| summarize attachmentCount=count() by tostring(path_parts.Extension)\r\n| render piechart",
          "size": 0,
          "title": "Number of suspicious files detected in 48 hours",
          "timeContext": {
            "durationMs": 172800000
          },
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces",
          "chartSettings": {
            "yAxis": [
              "attachmentCount"
            ]
          }
        },
        "name": "query - 1"
      }
    ],
    "fromTemplateId": "sentinel-KnowBe4DefendMetricWorkbook",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }