{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "Please select the Log Analytics Workspace with 'NetworkAccessGenerativeAIInsights' and 'NetworkAccessTrafficLogs' enabled through 'Diagnostic settings' in Microsoft Entra ID",
        "style": "info"
      },
      "name": "text - 7",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 1,
      "content": {
        "json": "## MCP Servers Dashboard (Preview)\n---\nMonitor and analyze Model Context Protocol server activity and performance"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "crossComponentResources": [
          "value::all"
        ],
        "parameters": [
          {
            "id": "ff8b2a55-1849-4848-acf8-eab5452e9f10",
            "version": "KqlParameterItem/1.0",
            "name": "LogAnalyticWorkspace",
            "label": "Log Analytic Workspace",
            "type": 5,
            "description": "The Log Analytic Workspace In Which To Execute The Queries",
            "isRequired": true,
            "multiSelect": true,
            "quote": "'",
            "delimiter": ",",
            "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id",
            "crossComponentResources": [
              "value::all"
            ],
            "typeSettings": {
              "resourceTypeFilter": {
                "microsoft.operationalinsights/workspaces": true
              },
              "additionalResourceOptions": [
                "value::1",
                "value::all"
              ],
              "showDefault": false
            },
            "timeContext": {
              "durationMs": 2592000000
            },
            "defaultValue": "value::all",
            "queryType": 1,
            "resourceType": "microsoft.resourcegraph/resources",
            "value": [
              "value::all"
            ]
          },
          {
            "id": "f15f34d8-8e2d-4c39-8dee-be2f979c86a8",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            },
            "value": {
              "durationMs": 86400000
            }
          }
        ],
        "style": "pills",
        "queryType": 1,
        "resourceType": "microsoft.resourcegraph/resources"
      },
      "name": "parameters - 15"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let base = (\n    NetworkAccessGenerativeAIInsights\n    | extend jsonData = parse_json(Content)\n    | extend clientName = tostring(jsonData.params.clientInfo.name)\n    | extend clientVersion = tostring(jsonData.params.clientInfo.version)\n);\nlet prev = (\n    union\n        (base\n         | where Activity == \"Mcp\" and EventType == \"Response\"\n         | summarize by clientName, clientVersion\n         | count\n         | extend snapshot = \"Total MCP Servers\"),\n        (base\n         | where Activity == \"Mcp\"\n         | summarize by clientName, clientVersion\n         | count\n         | extend snapshot = \"Total MCP Clients\"),\n        (base\n         | count\n         | extend snapshot = \"Total Traffic\")\n    | project snapshot, prevCount = Count\n);\nprev\n| extend sortKey = case(snapshot == \"Total Traffic\", 1,\n                        snapshot == \"Total MCP Clients\", 2,\n                        snapshot == \"Total MCP Servers\", 3,\n                        99)\n| order by sortKey asc\n| project snapshot, prevCount\n",
        "size": 3,
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "crossComponentResources": [
          "{LogAnalyticWorkspace}"
        ],
        "visualization": "tiles",
        "gridSettings": {
          "rowLimit": 100
        },
        "sortBy": [],
        "tileSettings": {
          "titleContent": {
            "columnMatch": "snapshot"
          },
          "leftContent": {
            "columnMatch": "prevCount",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal"
              }
            }
          },
          "showBorder": true,
          "styleSettings": {
            "backgroundColor": "colorGray100",
            "fontSize": "large"
          },
          "tileSize": "large",
          "tilesPerRow": 1
        },
        "statSettings": {
          "valueField": "",
          "valueAggregation": "None",
          "colorSettings": {
            "type": "none",
            "mode": "background",
            "heatmapPalette": "greenRed",
            "thresholdsGrid": []
          },
          "iconSettings": {
            "thresholdsGrid": []
          },
          "tagText": "",
          "valueFontStyle": "auto"
        }
      },
      "name": "MCP Overview"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\" and EventType == \"Response\"\r\n| extend\r\n    jsonData = parse_json(Content)\r\n| extend serverName = tostring(jsonData.result.serverInfo.name)\r\n| extend serverVersion = tostring(jsonData.result.serverInfo.version)\r\n| where serverName != \"\" or serverVersion !=\"\"\r\n| extend serverNameVersion = strcat(serverName, \"_\", serverVersion)\r\n| summarize count() by serverNameVersion\r\n",
              "size": 4,
              "title": "Top Active MCP Server",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "barchart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "TopActiveMcpServersQuery"
          }
        ]
      },
      "customWidth": "33",
      "name": "TopActiveMCPServers",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\" and EventType == \"Request\"\r\n| extend\r\n    jsonData = parse_json(Content)\r\n| extend clientName = tostring(jsonData.params.clientInfo.name)\r\n| extend clientVersion = tostring(jsonData.params.clientInfo.version)\r\n| where clientName != \"\" or clientVersion !=\"\"\r\n| extend ClientNameVersion = strcat(clientName, \"_\", clientVersion)\r\n| summarize count() by ClientNameVersion\r\n",
              "size": 4,
              "title": "Top Active MCP Clients",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "barchart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "TopActiceMcpClientQuery"
          }
        ]
      },
      "customWidth": "33",
      "name": "TopActiveMCPSClients",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\"\r\n| summarize count() by UserPrincipalName",
              "size": 4,
              "title": "Top Users and AI Agents",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "barchart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "TopUsersAndAiAgentsQuery"
          }
        ]
      },
      "customWidth": "33",
      "name": "TopUsersAndAiAgentsQueryGroup",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\"\r\n| summarize SubActivity=dcount(SubActivity), TransactionId=dcount(TransactionId) by bin(TimeGenerated,1d)",
              "size": 4,
              "title": "MCP Usage Trend",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "linechart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              },
              "chartSettings": {
                "xAxis": "TimeGenerated",
                "showLegend": true,
                "showDataPoints": true
              }
            },
            "name": "McpUsageTrendQuery"
          }
        ]
      },
      "customWidth": "33",
      "name": "McpUsageTrend",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\"\r\n| summarize count() by SubActivity",
              "size": 4,
              "title": "API Call Types Breakdown",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "piechart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "ApiCallsTypeQuery",
            "styleSettings": {
              "margin": "33"
            }
          }
        ]
      },
      "customWidth": "33",
      "name": "ApiCallsType",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\" and EventType == \"Response\"\r\n| extend protocolversion = extractjson(\"$.result.protocolVersion\", Content)\r\n| where isnotempty(protocolversion)\r\n| summarize count() by protocolversion\r\n",
              "size": 4,
              "title": "MCP Server Version Distribution",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "visualization": "piechart",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "MCPServerVersionDistributionQuery"
          }
        ]
      },
      "customWidth": "33",
      "name": "MCPServerVersionDistribution",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "NetworkAccessGenerativeAIInsights\r\n| where Activity == \"Mcp\" and EventType == \"Response\"\r\n| extend\r\n    jsonData = parse_json(Content)\r\n| extend serverName = tostring(jsonData.result.serverInfo.name)\r\n| extend serverVersion = tostring(jsonData.result.serverInfo.version)\r\n| where serverName != \"\" or serverVersion !=\"\"\r\n| extend serverDetails = strcat(DestinationUrl, \" (\",serverName, \", \", serverVersion,\")\")\r\n| summarize ToolsCount = dcount(SubActivity), ToolsAndResource= make_set(SubActivity, 10), TransactionCount=dcount(TransactionId), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by serverDetails",
              "size": 4,
              "title": "MCP Servers Details",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "crossComponentResources": [
                "{LogAnalyticWorkspace}"
              ],
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "snapshot"
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "styleSettings": {
                  "backgroundColor": "colorGray100"
                }
              }
            },
            "name": "McpServerDetailsQuery"
          }
        ]
      },
      "name": "McpServerDetailsQueryGroup",
      "styleSettings": {
        "showBorder": true
      }
    }
  ],
  "fallbackResourceIds": [
    "Global Secure Access"
  ],
  "fromTemplateId": "MCP Insights",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}