{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "9ce8b817-f1ac-44c1-9803-9c29fb852094",
            "version": "KqlParameterItem/1.0",
            "name": "Time",
            "type": 4,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "timeContext": {
              "durationMs": 86400000
            }
          },
          {
            "id": "b5012d54-1341-451b-8c19-2464dad7400d",
            "version": "KqlParameterItem/1.0",
            "name": "RuleName",
            "label": "Rule Name",
            "type": 1,
            "timeContext": {
              "durationMs": 86400000
            },
            "value": ""
          },
          {
            "id": "1e9c0aed-d257-4426-abd4-26d1f244705f",
            "version": "KqlParameterItem/1.0",
            "name": "Severity",
            "type": 2,
            "typeSettings": {
              "showDefault": false
            },
            "jsonData": "[\r\n    { \"value\":\"Critical\", \"label\":\"Critical\" },\r\n    { \"value\":\"Warning\" , \"label\":\"Warning\" },\r\n    { \"value\":\"Informational\" , \"label\":\"Informational\" }\r\n]",
            "timeContext": {
              "durationMs": 86400000
            },
            "value": null
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "(SecurityEvent\r\n| where EventSourceName == 'Semperis-DSP-Notifications' \r\n| extend p1Xml = parse_xml(EventData).EventData.Data\r\n| mv-expand bagexpansion=array p1Xml\r\n| evaluate bag_unpack(p1Xml)\r\n| extend Name=column_ifexists(tostring('@Name'), ''), columnValue=column_ifexists('#text', '')\r\n| evaluate pivot(Name, any(columnValue), TimeGenerated, EventSourceName, Channel, Computer, Level, EventLevelName, EventID, Task, Type, _ResourceId)\r\n| extend RuleName=tostring(column_ifexists('ruleName', '')), Severity=tostring(column_ifexists('severity', '')), DataSource=tostring(column_ifexists('dataSource', '')), ObjectDN=tostring(column_ifexists('objectDN', '')), TimeCreated=tostring(column_ifexists('timeCreated', '')), Operation=tostring(column_ifexists('fullOperation', '')), Attribute=tostring(column_ifexists('attributeName', '')), Value=tostring(column_ifexists('attributeValue', '')), ChangedBy=tostring(column_ifexists('changedBy', '')), Source=tostring(column_ifexists('Computer', '')))\r\n| union\r\n(CommonSecurityLog\r\n| extend Activity=column_ifexists('Activity', ''), DeviceProduct=column_ifexists('DeviceProduct', '')\r\n| where Activity == 'rule-alert'\r\n| where DeviceProduct == 'Core Directory'\r\n| extend p1Array = split(AdditionalExtensions,\"|\")\r\n| mv-expand bagexpansion=array p1Array\r\n| evaluate bag_unpack(p1Array)\r\n| extend Name=tostring(split(p1Array,\"=\")[0]),Value=substring(p1Array,indexof(p1Array,\"=\")+1)\r\n| extend Value=replace_string(Value, \";\", \" \")\r\n| evaluate pivot(Name, any(Value), TimeGenerated, TenantId, DeviceVendor, DeviceProduct, DeviceVersion, DeviceEventClassID, Activity, LogSeverity, OriginalLogSeverity, DeviceAction)\r\n| extend RuleName=column_ifexists('ruleName', ''), Severity=column_ifexists('severity', ''), DataSource=column_ifexists('dataSources', ''), ObjectDN=column_ifexists('subjectId', ''), TimeCreated=column_ifexists('alertCreated', ''), Operation=column_ifexists('operation', ''), Attribute=column_ifexists('attribute', ''), Value=column_ifexists('value', ''), ChangedBy=column_ifexists('changedBy', ''), Source=column_ifexists('alertSource', '')\r\n| extend Severity = case(toint(Severity) == 1 or toint(Severity) == 2, \"Informational\", toint(Severity)==3 or toint(Severity)==4, \"Low\", toint(Severity)==5 or toint(Severity)==6, \"Medium\", toint(Severity)==7 or toint(Severity)==8, \"High\", toint(Severity)==9 or toint(Severity)==10, \"Critical\", \"\"))\r\n| where (isempty('{Time}') or (todatetime(TimeCreated) >= todatetime('{Time:startISO}') and todatetime(TimeCreated) <= todatetime('{Time:endISO}'))) and ((isempty('{RuleName}') or indexof(RuleName,'{RuleName}') > -1)) and ((isempty('{Severity}') or Severity == '{Severity}'))\r\n| order by TimeGenerated desc\r\n| project RuleName, Severity, DataSource, ObjectDN, TimeCreated, Operation, Attribute, Value, ChangedBy, Source",
        "size": 0,
        "title": "Notifications",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "labelSettings": [
            {
              "columnId": "RuleName",
              "label": "Rule Name"
            },
            {
              "columnId": "DataSource",
              "label": "Data Source"
            },
            {
              "columnId": "ObjectDN",
              "label": "Object DN"
            },
            {
              "columnId": "TimeCreated",
              "label": "Time Created"
            },
            {
              "columnId": "ChangedBy",
              "label": "Changed By"
            }
          ]
        }
      },
      "name": "query - 1"
    }
  ],
  "fromTemplateId": "sentinel-SemperisDSPNotifications",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}