{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "f951ba63-69db-4e29-b73e-700430a58329", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Email Activity Summary", "subTarget": "2", "style": "link" }, { "id": "6cb5e992-de3d-43c4-8b2c-32b56cf33cc1", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Email Receipt", "subTarget": "1", "preText": "Email Receipt", "style": "link" }, { "id": "43335114-8770-48e6-b02f-c9b7ee185cc1", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Email Delivery", "subTarget": "3", "style": "link" }, { "id": "ffbb9e0f-8551-4797-b28a-fdda3671f1f5", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "AV / AS", "subTarget": "7", "style": "link" }, { "id": "7438a20b-c11b-45b9-8c90-1e69e47fa220", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "TLS", "subTarget": "4", "style": "link" }, { "id": "312e014c-a77d-4b0f-8d76-e25c13ed3716", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Email Spam", "subTarget": "8", "style": "link", "linkIsContextBlade": true }, { "id": "6d11cffc-b20e-42be-95d1-8812a2d876e5", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Internal Email Protect", "subTarget": "6", "style": "link" }, { "id": "b2026a8b-8136-4d89-b26c-cffda38fcdee", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Email Journal", "subTarget": "9", "style": "link" }, { "id": "8605b3c8-3b53-42ac-9e6c-cbf235909733", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Data Leak Prevention", "subTarget": "5", "style": "link" } ] }, "name": "links - 1" }, { "type": 1, "content": { "json": "--- " }, "name": "text - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "b627c016-a002-4b73-a1b6-9c2e30f91d86", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type ==\"email_delivery\"\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Direction", "size": 0, "showAnalytics": true, "title": "Email Traffic", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(\r\n MimecastCG \r\n | where Type == \"email_receipt\" and isnotempty(['Rejection Type'])\r\n | summarize min_time = min(['Event Time'])\r\n | extend min_t = iff(isempty(min_time),now(),min_time)\r\n | project min_t);\r\nMimecastCG \r\n| where Type == \"email_receipt\" and isnotempty(['Rejection Type']) \r\n| make-series Trend = count() default = 0 on ['Event Time'] from min_t to now() step 1d by tostring(['Rejection Type']) \r\n| project-away ['Event Time'] \r\n| extend Count = array_sum(Trend) \r\n| project ['Rejection Type'] , Count, ['Spark Line'] = Trend \r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Rejections", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "lightBlue" } }, { "columnMatch": "Spark Line", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "33", "name": "query - 2", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "\r\nlet min_t = toscalar(\r\n MimecastCG \r\n | where Type == \"email_delivery\" and isnotempty(['Rejection Type'])\r\n | summarize min_time = min(['Event Time'])\r\n | extend min_t = iff(isempty(min_time),now(),min_time)\r\n | project min_t);\r\nMimecastCG \r\n| where Type == \"email_delivery\" and isnotempty(['Rejection Type'])\r\n| make-series Trend = count() default = 0 on ['Event Time'] from min_t to now() step 1d by tostring(['Rejection Type']) \r\n| project-away ['Event Time'] \r\n| extend Count = array_sum(Trend) \r\n| project ['Rejection Type'], Count, ['Spark Line'] = Trend \r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Delivery Failures", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "lightBlue" } }, { "columnMatch": "Spark Line", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "name": "query - 2 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let min_t = toscalar(\r\n MimecastCG\r\n | where Type == \"email_process\" and isnotempty(['Hold Reason'])\r\n | summarize min_time = min(['Event Time'])\r\n | extend min_t = iff(isempty(min_time),now(),min_time)\r\n | project min_t);\r\nMimecastCG\r\n| where Type == \"email_process\" and isnotempty(['Hold Reason'])\r\n| make-series Trend = count() default = 0 on ['Event Time'] from min_t to now() step 1d by tostring(['Hold Reason'])\r\n| project-away ['Event Time']\r\n| extend Count=array_sum(Trend)\r\n| project ['Hold Reason'], Count,['Spark Line'] = Trend\r\n| order by Count desc", "size": 0, "showAnalytics": true, "title": "Held", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 4, "formatOptions": { "min": 0, "palette": "lightBlue" } }, { "columnMatch": "Spark Line", "formatter": 9, "formatOptions": { "palette": "blue" } } ] } }, "customWidth": "50", "name": "query - 2 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "2" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3eec960e-69f2-487a-986f-e3b495ce6818", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0", "styleSettings": { "margin": "5px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| summarize count() by Direction, Action, ['Sender IP']\r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_", "size": 3, "showAnalytics": true, "title": "Total Messages Received", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessagesReceived" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| where Action in~ (\"Acc\", \"RTY\")\r\n| summarize count() by Direction, Action, ['Sender IP']\r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_\r\n", "size": 3, "showAnalytics": true, "title": "Total Messages Accepted", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessagesAccepted" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| where Action in~ (\"REJ\", \"BNC\")\r\n| summarize count() by Direction, Action, ['Sender IP']\r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_\r\n\r\n// Rej and Bnc are considered as blocked", "size": 3, "showAnalytics": true, "title": "Total Messages Rejected", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessagesRejected" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "amethyst" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\" and Action in~ (\"Acc\", \"RTY\")\r\n| where isempty( ['TLS Version'])\r\n| summarize count() by Direction, Action, ['Sender IP']\r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_\r\n\r\n//Acc and Rty are considered as delivered", "size": 3, "showAnalytics": true, "title": "Total Messages Accepted without TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessagesAcceptedwithoutTLS" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "orangeDark" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 1, "content": { "json": "💡 To view message details, please click on any of the tiles above" }, "conditionalVisibility": { "parameterName": "TileAction", "comparison": "isEqualTo" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| project ['Aggregate ID'] ,\r\n['Processing ID'],\r\n['Account ID'] ,\r\n['Action'],\r\n['Type'],\r\n['Sender Envelope'] ,\r\n['Message ID'] ,\r\n['Subject'],\r\n['Recipients'] ,\r\n['Sender IP'] ,\r\n['Rejection Type'] ,\r\n['Rejection Code'] ,\r\n['Direction'] ,\r\n['Number of Attachments'] ,\r\n['Sender Header'] ,\r\n['Rejection Info'] ,\r\n[\"TLS Version\"],\r\n[\"TLS Cipher\"],\r\n['Spam Info'] ,\r\n['Spam Processing Detail'] ,\r\n['Virus Found'] ,\r\n['Event Time'] ,\r\n['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Messages Received", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessagesReceived", "comparison": "isNotEqualTo" }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| where Action in~ (\"Acc\", \"RTY\")\r\n| project ['Aggregate ID'] ,\r\n['Processing ID'],\r\n['Account ID'] ,\r\n['Action'],\r\n['Type'],\r\n['Sender Envelope'] ,\r\n['Message ID'] ,\r\n['Subject'],\r\n['Recipients'] ,\r\n['Sender IP'] ,\r\n['Rejection Type'] ,\r\n['Rejection Code'] ,\r\n['Direction'] ,\r\n['Number of Attachments'] ,\r\n['Sender Header'] ,\r\n['Rejection Info'] ,\r\n[\"TLS Version\"],\r\n[\"TLS Cipher\"],\r\n['Spam Info'] ,\r\n['Spam Processing Detail'] ,\r\n['Virus Found'] ,\r\n['Event Time'] ,\r\n['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Messages Accepted", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessagesAccepted", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\"\r\n| where Action in~ (\"REJ\", \"BNC\")\r\n| project ['Aggregate ID'] ,\r\n['Processing ID'],\r\n['Account ID'] ,\r\n['Action'],\r\n['Type'],\r\n['Sender Envelope'] ,\r\n['Message ID'] ,\r\n['Subject'],\r\n['Recipients'] ,\r\n['Sender IP'] ,\r\n['Rejection Type'] ,\r\n['Rejection Code'] ,\r\n['Direction'] ,\r\n['Number of Attachments'] ,\r\n['Sender Header'] ,\r\n['Rejection Info'] ,\r\n[\"TLS Version\"],\r\n[\"TLS Cipher\"],\r\n['Spam Info'] ,\r\n['Spam Processing Detail'] ,\r\n['Virus Found'] ,\r\n['Event Time'] ,\r\n['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Messages Rejected", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessagesRejected", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and Action in~ (\"Acc\", \"RTY\")\r\n| where isempty([\"TLS Version\"])\r\n| project \r\n['Aggregate ID'] ,\r\n['Processing ID'] ,\r\n['Account ID'],\r\n['Action'],\r\n['Type'],\r\n['Sender Envelope'],\r\n['Message ID'] ,\r\n['Subject'] ,\r\n['Recipients'] ,\r\n['Sender IP'] ,\r\n['Rejection Type'] ,\r\n['Rejection Code'] ,\r\n['Direction'] ,\r\n['Number of Attachments'] ,\r\n['Sender Header'] ,\r\n['Rejection Info'],\r\n[\"TLS Version\"],\r\n[\"TLS Cipher\"],\r\n['Spam Info'] ,\r\n['Spam Processing Detail'] ,\r\n['Virus Found'] ,\r\n['Event Time'],\r\n['Sub Type']", "size": 0, "showAnalytics": true, "title": "Messages Accepted without TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessagesAcceptedwithoutTLS", "comparison": "isNotEqualTo" }, "name": "query - 2 - Copy - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "name": "group - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\" and Action in~ (\"Acc\", \"RTY\")\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Direction", "size": 0, "showAnalytics": true, "title": "Messages Accepted by Route", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\" and Action in~ (\"Acc\", \"RTY\") and isnotempty( ['Sender IP'])\r\n| extend senderGeoDetails = geo_info_from_ip_address(['Sender IP'])\r\n| extend latitude = senderGeoDetails.latitude, longitude = senderGeoDetails.longitude, country = senderGeoDetails.country, state = senderGeoDetails.state, city = senderGeoDetails.city\r\n| where isnotempty(latitude) and isnotempty(longitude)\r\n| extend label = strcat(\r\n iif(strlen(city) > 0, strcat(city, \", \"), \"\"),\r\n iif(strlen(state) > 0, strcat(state, \", \"), \"\"),\r\n country\r\n)\r\n| extend label = trim(\", \", label)\r\n| extend label = iif(strlen(label) > 0, label, \"N/A\")\r\n| summarize count() by tostring(latitude), tostring(longitude), label", "size": 0, "showAnalytics": true, "title": "Messages Accepted by Source Country", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "minData": -1, "labelSettings": "label", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type== \"email_receipt\" and Action in~ (\"REJ\", \"BNC\") and isnotempty( ['Sender IP'])\r\n| extend senderGeoDetails = geo_info_from_ip_address(['Sender IP'])\r\n| extend latitude = senderGeoDetails.latitude, longitude = senderGeoDetails.longitude, country = senderGeoDetails.country, state = senderGeoDetails.state, city = senderGeoDetails.city\r\n| where isnotempty(latitude) and isnotempty(longitude)\r\n| extend label = strcat(\r\n iif(strlen(city) > 0, strcat(city, \", \"), \"\"),\r\n iif(strlen(state) > 0, strcat(state, \", \"), \"\"),\r\n country\r\n)\r\n| extend label = trim(\", \", label)\r\n| extend label = iif(strlen(label) > 0, label, \"N/A\")\r\n| summarize count() by tostring(latitude), tostring(longitude), label", "size": 0, "showAnalytics": true, "title": "Messages Rejected by Source Country", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "minData": -1, "labelSettings": "label", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 3 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "1" }, "name": "group - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3eec960e-69f2-487a-986f-e3b495ce6818", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\"\r\n| summarize count() by Direction , Delivered , ['Destination IP'] , ['TLS Used'] \r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_", "size": 3, "showAnalytics": true, "title": "Total Messages Delivered", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessageDelivered" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "palette": "auto" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0", "styleSettings": { "margin": "5px", "maxWidth": "25%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"false\" and Direction == \"Outbound\"\r\n| summarize count() by Direction , Delivered , ['TLS Used'] \r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_", "size": 3, "showAnalytics": true, "title": "Total Outbound Delivery Failures", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "Outbounddeliveryfailures" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "purple" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "25%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"false\" and Direction == \"Inbound\"\r\n| summarize count() by Direction , Delivered , ['Destination IP'] , ['TLS Used'] \r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_", "size": 3, "showAnalytics": true, "title": "Total Inbound Delivery Failures", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "InboundDeliveryFailures" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "greenDark" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy - Copy", "styleSettings": { "margin": "5px", "maxWidth": "25%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\" and ['TLS Used'] == \"No\"\r\n| summarize count() by Direction , Delivered , ['Destination IP'] , ['TLS Used'] \r\n| summarize sum(count_)\r\n| project TotalCount = sum_count_", "size": 3, "showAnalytics": true, "title": "Total Messages Delivered without TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "TotalCount", "parameterName": "MessagesDeliveredwithoutTLS" }, { "fieldName": "TotalCount", "parameterName": "TileAction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "TotalCount", "formatter": 12, "formatOptions": { "min": -1, "palette": "orangeDark" } }, "showBorder": false } }, "customWidth": "25", "name": "query - 0 - Copy - Copy", "styleSettings": { "margin": "5px", "maxWidth": "25%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 To view message details, please click on any of the tiles above" }, "conditionalVisibility": { "parameterName": "TileAction", "comparison": "isEqualTo" }, "name": "text - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\"\r\n| project \r\n [\"Aggregate ID\"] ,\r\n [\"Processing ID\"],\r\n [\"Delivered\"] ,\r\n [\"Destination IP\"] ,\r\n [\"Host Name\"],\r\n [\"Delivery Attempts\"] ,\r\n [\"TLS Used\"] ,\r\n [\"Route\"] ,\r\n [\"Account ID\"] ,\r\n [\"Event Time\"] ,\r\n [\"Sender Envelope\"] ,\r\n [\"Message ID\"] ,\r\n [\"Subject\"] ,\r\n [\"Total of Size Attachments\"] ,\r\n [\"Number of Attachments\"] ,\r\n [\"Email Size\"] ,\r\n [\"Type\"] ,\r\n [\"Sub Type\"] ,\r\n [\"Recipients\"] ,\r\n [\"Direction\"] ,\r\n [\"TLS Version\"] ,\r\n [\"TLS Cipher\"] ,\r\n [\"Delivery Errors\"] ,\r\n [\"Rejection Type\"] ,\r\n [\"Rejection Code\"] ,\r\n [\"Rejection Info\"] \r\n", "size": 0, "showAnalytics": true, "title": "Messages Delivered", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessageDelivered", "comparison": "isNotEqualTo" }, "name": "query - 7", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"false\" and Direction == \"Outbound\"\r\n| project \r\n [\"Aggregate ID\"] ,\r\n [\"Processing ID\"],\r\n [\"Delivered\"] ,\r\n [\"Destination IP\"] ,\r\n [\"Host Name\"] ,\r\n [\"Delivery Attempts\"] ,\r\n [\"TLS Used\"] ,\r\n [\"Route\"] ,\r\n [\"Account ID\"] ,\r\n [\"Event Time\"] ,\r\n [\"Sender Envelope\"] ,\r\n [\"Message ID\"] ,\r\n [\"Subject\"] ,\r\n [\"Total of Size Attachments\"] ,\r\n [\"Number of Attachments\"] ,\r\n [\"Email Size\"] ,\r\n [\"Type\"] ,\r\n [\"Sub Type\"] ,\r\n [\"Recipients\"] ,\r\n [\"Direction\"] ,\r\n [\"TLS Version\"] ,\r\n [\"TLS Cipher\"] ,\r\n [\"Delivery Errors\"] ,\r\n [\"Rejection Type\"] ,\r\n [\"Rejection Code\"] ,\r\n [\"Rejection Info\"] \r\n\r\n", "size": 0, "showAnalytics": true, "title": "Outbound Delivery Failures", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Outbounddeliveryfailures", "comparison": "isNotEqualTo" }, "name": "query - 8", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"false\" and Direction == \"Inbound\"\r\n| project \r\n [\"Aggregate ID\"] ,\r\n [\"Processing ID\"],\r\n [\"Delivered\"] ,\r\n [\"Destination IP\"] ,\r\n [\"Host Name\"] ,\r\n [\"Delivery Attempts\"] ,\r\n [\"TLS Used\"] ,\r\n [\"Route\"] ,\r\n [\"Account ID\"] ,\r\n [\"Event Time\"] ,\r\n [\"Sender Envelope\"] ,\r\n [\"Message ID\"] ,\r\n [\"Subject\"] ,\r\n [\"Total of Size Attachments\"] ,\r\n [\"Number of Attachments\"] ,\r\n [\"Email Size\"] ,\r\n [\"Type\"] ,\r\n [\"Sub Type\"] ,\r\n [\"Recipients\"] ,\r\n [\"Direction\"] ,\r\n [\"TLS Version\"] ,\r\n [\"TLS Cipher\"] ,\r\n [\"Delivery Errors\"] ,\r\n [\"Rejection Type\"] ,\r\n [\"Rejection Code\"] ,\r\n [\"Rejection Info\"] \r\n\r\n", "size": 0, "showAnalytics": true, "title": "Inbound Delivery Failures", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "InboundDeliveryFailures", "comparison": "isNotEqualTo" }, "name": "query - 8 - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\" and [\"TLS Used\"] == \"No\"\r\n| project \r\n [\"Aggregate ID\"] ,\r\n [\"Processing ID\"],\r\n [\"Delivered\"] ,\r\n [\"Destination IP\"] ,\r\n [\"Host Name\"] ,\r\n [\"Delivery Attempts\"] ,\r\n [\"TLS Used\"] ,\r\n [\"Route\"] ,\r\n [\"Account ID\"] ,\r\n [\"Event Time\"] ,\r\n [\"Sender Envelope\"] ,\r\n [\"Message ID\"] ,\r\n [\"Subject\"] ,\r\n [\"Total of Size Attachments\"] ,\r\n [\"Number of Attachments\"] ,\r\n [\"Email Size\"] ,\r\n [\"Type\"] ,\r\n [\"Sub Type\"] ,\r\n [\"Recipients\"] ,\r\n [\"Direction\"] ,\r\n [\"TLS Version\"] ,\r\n [\"TLS Cipher\"] ,\r\n [\"Delivery Errors\"] ,\r\n [\"Rejection Type\"] ,\r\n [\"Rejection Code\"] ,\r\n [\"Rejection Info\"] \r\n\r\n", "size": 0, "showAnalytics": true, "title": "Messages Delivered without TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "MessagesDeliveredwithoutTLS", "comparison": "isNotEqualTo" }, "name": "query - 8 - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\" \r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Direction", "size": 0, "showAnalytics": true, "title": "Messages Delivered by Route", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 4", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\"\r\n| project \r\n [\"Aggregate ID\"] ,\r\n [\"Processing ID\"],\r\n [\"Delivered\"] ,\r\n [\"Destination IP\"] ,\r\n [\"Host Name\"] ,\r\n [\"Delivery Attempts\"] ,\r\n [\"TLS Used\"] ,\r\n [\"Route\"] ,\r\n [\"Account ID\"] ,\r\n [\"Event Time\"] ,\r\n [\"Sender Envelope\"] ,\r\n [\"Message ID\"] ,\r\n [\"Subject\"] ,\r\n [\"Total of Size Attachments\"] ,\r\n [\"Number of Attachments\"] ,\r\n [\"Email Size\"] ,\r\n [\"Type\"] ,\r\n [\"Sub Type\"] ,\r\n [\"Recipients\"] ,\r\n [\"Direction\"] ,\r\n [\"TLS Version\"] ,\r\n [\"TLS Cipher\"] ,\r\n [\"Delivery Errors\"] ,\r\n [\"Rejection Type\"] ,\r\n [\"Rejection Code\"] ,\r\n [\"Rejection Info\"] \r\n\r\n", "size": 0, "showAnalytics": true, "title": "Message Delivery Events", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 7", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\" and Direction == \"Outbound\"\r\n| summarize Count = count() by Direction , Delivered , ['Destination IP'] , ['TLS Used'] \r\n| extend geo_info = geo_info_from_ip_address(['Destination IP'])\r\n| extend latitude = geo_info.latitude, longitude = geo_info.longitude, country = geo_info.country , state = geo_info.state , city = geo_info.state\r\n| where isnotempty(latitude) and isnotempty(longitude)\r\n| extend label = strcat(\r\n iif(strlen(city) > 0, strcat(city, \", \"), \"\"),\r\n iif(strlen(state) > 0, strcat(state, \", \"), \"\"),\r\n country\r\n)\r\n| extend label = trim(\", \", label)\r\n| extend label = iif(strlen(label) > 0, label, \"N/A\")\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Messages Delivered Outbound by Destination Country", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "locInfoColumn": "DestinationIp", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "Count", "sizeAggregation": "Sum", "labelSettings": "label", "legendMetric": "Count", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "Count", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "3" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "578d7b4c-c261-429f-b39e-a7d3c5ef2d66", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type ==\"email_antivirus\"\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Route", "size": 0, "showAnalytics": true, "title": "Anti-Virus Traffic", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and Action in~ (\"Acc\", \"Rty\") and ['Rejection Type'] ==\"Virus Signature Detection\"\r\n| summarize count() \r\n", "size": 3, "showAnalytics": true, "title": "Total Viruses Rejected", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "count_", "parameterName": "CountTVR", "parameterType": 1 }, { "fieldName": "count_", "parameterName": "Tileaction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "33", "name": "query - 0", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty( ['Spam Info']) and ['Spam Info'] != \"[]\"\r\n| summarize count() \r\n", "size": 3, "showAnalytics": true, "title": "Total Messages Rejected as Spam", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "count_", "parameterName": "CountRS", "parameterType": 1 }, { "fieldName": "count_", "parameterName": "Tileaction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "green" } }, "showBorder": false } }, "customWidth": "33", "name": "query - 0 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_process\" and ['Hold Reason'] == \"Spm\"\r\n| summarize count() \r\n\r\n", "size": 3, "showAnalytics": true, "title": "Total Messages Held as Spam", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "exportedParameters": [ { "fieldName": "count_", "parameterName": "CountHS", "parameterType": 1 }, { "fieldName": "count_", "parameterName": "Tileaction", "parameterType": 1 } ], "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "amethyst" } }, "showBorder": false } }, "customWidth": "33", "name": "query - 0 - Copy - Copy", "styleSettings": { "margin": "5px", "maxWidth": "33%", "showBorder": true } }, { "type": 1, "content": { "json": "💡 To view message details, please click on any of the tiles above" }, "conditionalVisibility": { "parameterName": "Tileaction", "comparison": "isEqualTo" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and Action in~ (\"Acc\", \"Rty\") and [\"Rejection Type\"] ==\"Virus Signature Detection\"\r\n| project [\"Aggregate ID\"], [\"Recipients\"] , [\"Action\"] , [\"Event Time\"] ,[\"Sender Envelope\"] , [\"Message ID\"] , [\"Subject\"] , [\"Number of Attachments\"] , [\"Type\"] = Type, [\"Sub Type\"] , [\"Sender IP\"] , [\"Direction\"], [\"Sender Header\"] , [\"TLS Version\"] , [\"TLS Cipher\"] , [\"Spam Info\"] ,[\"Virus Found\"] , [\"Spam Processing Detail\"],[\"Rejection Type\"] ,[\"Rejection Code\"], [\"Rejection Info\"] , [\"Processing ID\"] , [\"Account ID\"] \r\n\r\n", "size": 0, "showAnalytics": true, "title": "Viruses Rejected", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CountTVR", "comparison": "isNotEqualTo" }, "name": "query - 7", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty(['Spam Info']) and ['Spam Info'] != \"[]\"\r\n| project [\"Aggregate ID\"], [\"Recipients\"] , [\"Action\"] , [\"Event Time\"] ,[\"Sender Envelope\"] , [\"Message ID\"] , [\"Subject\"] , [\"Number of Attachments\"] , [\"Type\"] = Type, [\"Sub Type\"] , [\"Sender IP\"] , [\"Direction\"], [\"Sender Header\"] , [\"TLS Version\"] , [\"TLS Cipher\"] , [\"Spam Info\"] ,[\"Virus Found\"] , [\"Spam Processing Detail\"],[\"Rejection Type\"] ,[\"Rejection Code\"], [\"Rejection Info\"] , [\"Processing ID\"] , [\"Account ID\"] \r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Messages Rejected as Spam", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "conditionalVisibility": { "parameterName": "CountRS", "comparison": "isNotEqualTo" }, "name": "query - 0 - Copy - Copy", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_process\" and ['Hold Reason'] == \"Spm\"\r\n| project [\"Aggregate ID\"], [\"Recipients\"] , [\"Action\"] , [\"Event Time\"], ['Hold Reason'] ,[\"Sender Envelope\"] , [\"Message ID\"] , [\"Subject\"] , [\"Number of Attachments\"] , [\"Type\"] = Type, [\"Sub Type\"] , [\"Sender IP\"] , [\"Direction\"], [\"Sender Header\"] , [\"TLS Version\"] , [\"TLS Cipher\"] , [\"Spam Info\"] ,[\"Virus Found\"] , [\"Spam Processing Detail\"],[\"Rejection Type\"] ,[\"Rejection Code\"], [\"Rejection Info\"] , [\"Processing ID\"] , [\"Account ID\"] \r\n\r\n\r\n\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Messages Held as Spam", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "CountHS", "comparison": "isNotEqualTo" }, "name": "query - 9", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty(['Virus Found'])\r\n| summarize Count = count() by ['Sender Envelope'] , Recipients , ['Sender IP'],['Virus Found'] , ['Event Time']\r\n| sort by Count desc\r\n| extend Sender = ['Sender Envelope'] , Recipient = Recipients , [\"Source IP\"] = ['Sender IP'], [\"Virus Name\"] = ['Virus Found']\r\n| project Sender, Recipient, [\"Source IP\"], [\"Virus Name\"], Count , ['Event Time']\r\n| extend Count = iff(isnull(Count), 0, Count)\r\n", "size": 0, "showAnalytics": true, "title": "Messages Rejected Due to Virus", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "50", "name": "query - 0 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty(['Spam Info'] ) and ['Spam Info'] != \"[]\"\r\n| summarize Count = count() by ['Sender Envelope'] , Recipients , ['Sender IP'],['Spam Info'] , ['Event Time']\r\n| sort by Count desc\r\n| extend Sender = ['Sender Envelope'] , Recipient = Recipients , [\"Source IP\"] = ['Sender IP'], [\"Spam Information\"] = ['Spam Info'] \r\n| project Sender, Recipient, [\"Source IP\"], [\"Spam Information\"], Count ,['Event Time']\r\n| extend Count = iff(isnull(Count), 0, Count)\r\n", "size": 0, "showAnalytics": true, "title": "Messages Rejected as Spam", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "tileSettings": { "leftContent": { "columnMatch": "count_", "formatter": 12, "formatOptions": { "min": -1, "palette": "blue" } }, "showBorder": false } }, "customWidth": "50", "name": "query - 0 - Copy - Copy - Copy", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "7" }, "name": "group - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "02075565-ceae-47c2-ba15-44b2f74313c4", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered == \"true\" and isnotnull(['TLS Used'])\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by ['TLS Used']", "size": 0, "showAnalytics": true, "title": "TLS Delivery", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and Delivered== \"true\" and isnotempty(['TLS Version'])\r\n| summarize Count = count(Recipients) by bin(['Event Time'] , 1d), ['TLS Version']", "size": 0, "showAnalytics": true, "title": "TLS Versions (Delivery)", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "group": "TLS Version", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty(['TLS Version'])\r\n| summarize Count = count(Recipients) by bin(['Event Time'] , 1d), ['TLS Version']", "size": 0, "showAnalytics": true, "title": "TLS Versions (Receipt)", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "group": "TLS Version", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 2 - Copy", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and isnotempty(['TLS Cipher'])\r\n| summarize count() by Cipher = ['TLS Cipher'] \r\n| sort by count_ desc", "size": 0, "showAnalytics": true, "title": "Delivery Ciphers", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "rowLimit": 10000, "filter": true }, "chartSettings": { "group": "Cipher", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 2 - Copy - Copy", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and isnotempty(['TLS Cipher'])\r\n| summarize count() by Cipher = ['TLS Cipher'] \r\n| sort by count_ desc\r\n", "size": 0, "showAnalytics": true, "title": "Receipt Ciphers", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "gridSettings": { "rowLimit": 10000, "filter": true }, "chartSettings": { "group": "Cipher", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_delivery\" and ['TLS Used'] == \"No\" and Delivered == \"true\"\r\n| extend temp = split(Recipients, \"@\")\r\n| extend [\"Recipient Domain\"] = tostring(temp[1])\r\n| summarize Count = count() by [\"Recipient Domain\"] \r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top 10 Recipient Domains not Using TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "group": "*", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_receipt\" and Action in~ (\"Acc\", \"Rty\") and isempty(['TLS Version'])\r\n| extend temp = split(['Sender Envelope'], \"@\")\r\n| extend [\"Sending Domain\"] = tostring(temp[1])\r\n| summarize Count = count() by [\"Sending Domain\"] \r\n| top 10 by Count", "size": 0, "showAnalytics": true, "title": "Top 10 Sending Domains not Using TLS", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "group": "Sending Domain", "createOtherGroup": null } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "4" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "cbe43313-4782-4061-b7c0-d48e146bfeb1", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastDLP\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Action\n", "size": 0, "showAnalytics": true, "title": "Data Leak Prevention Events", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "group": "*", "createOtherGroup": 25, "seriesLabelSettings": [ { "seriesName": "data_leak_prevention_notification", "label": "Notification" }, { "seriesName": "data_leak_prevention_hold", "label": "Hold" }, { "seriesName": "data_leak_prevention_smart_folder", "label": "Smart Folder" }, { "seriesName": "data_leak_prevention_secure_messaging", "label": "Secure Messaging" }, { "seriesName": "data_leak_prevention_secure_delivery", "label": "Secure Delivery" }, { "seriesName": "data_leak_prevention_bounce", "label": "Bounce" }, { "seriesName": "data_leak_prevention_stationery", "label": "Stationary" }, { "seriesName": "data_leak_prevention_delete", "label": "Delete" }, { "seriesName": "data_leak_prevention_meta_expire", "label": "Meta Expire" }, { "seriesName": "data_leak_prevention_content_expire", "label": "Content Expire" } ] } }, "name": "query - 23", "styleSettings": { "margin": "5px" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastDLP\n| summarize count() by Route\n", "size": 3, "showAnalytics": true, "title": "DLP Events by Route", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Route", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 30", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastDLP\n| summarize count() by Action\n", "size": 3, "showAnalytics": true, "title": "DLP Events by Actions Triggered", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Action", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 29", "styleSettings": { "margin": "5px", "maxWidth": "33%" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastDLP\n| summarize count() by Policy\n", "size": 3, "showAnalytics": true, "title": "DLP Events by Policies Triggered", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart", "chartSettings": { "group": "Policy", "createOtherGroup": 10, "showMetrics": false, "showLegend": true } }, "customWidth": "33", "name": "query - 27", "styleSettings": { "margin": "5px", "maxWidth": "33%" } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "5" }, "name": "group - 36" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ba10bbf5-0743-4e41-8555-11302a815979", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_iep\"\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Route", "size": 0, "showAnalytics": true, "title": "Internal Email Protection by Route", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_iep\"\r\n| project\r\n ['Aggregate ID'],\r\n ['Processing ID'] ,\r\n ['Account ID'] ,\r\n Type,\r\n ['Event Time'],\r\n ['Sender Envelope'] ,\r\n Subject,\r\n Recipients,\r\n ['Url Category'],\r\n ['Scan Results'] ,\r\n Route,\r\n ['Message ID'] ,\r\n ['Monitored Domain Source'] ,\r\n ['Similar Domain'] ,\r\n ['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Internal Event Protection Events", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "6" }, "name": "group - 8" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ba10bbf5-0743-4e41-8555-11302a815979", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_journal\"\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Direction", "size": 0, "showAnalytics": true, "title": "Journal Messages by Direction", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_journal\"\r\n| project\r\n ['Aggregate ID'] ,\r\n ['Processing ID'],\r\n ['Account ID'],\r\n Type,\r\n ['Event Time'],\r\n ['Sender Envelope'] ,\r\n Recipients,\r\n Direction,\r\n ['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Journal Message Events", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "9" }, "name": "group - 8 - Copy" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3301a4a8-8498-43bd-8a9b-fd331320f2a6", "version": "KqlParameterItem/1.0", "name": "Time_Range", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ] }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 1209600000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type ==\"email_spam\" and isnotempty(Route)\r\n| make-series Count=count() default=0 on ['Event Time'] step 1d by Route", "size": 0, "showAnalytics": true, "title": "Spam Messages by Route", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart" }, "name": "query - 1", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_spam\"\r\n| project\r\n ['Aggregate ID'] ,\r\n ['Processing ID'],\r\n ['Account ID'] ,\r\n Type,\r\n ['Event Time'],\r\n ['Sender Envelope'] ,\r\n Subject,\r\n Recipients,\r\n ['Sender IP'] ,\r\n ['Sender Domain'] ,\r\n ['Sender Header'],\r\n Route,\r\n ['Sub Type'] ", "size": 0, "showAnalytics": true, "title": "Spam Message Events", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastCG\r\n| where Type == \"email_spam\" and isnotempty(['Sender IP'])\r\n| extend senderGeoDetails = geo_info_from_ip_address(['Sender IP'])\r\n| extend latitude = senderGeoDetails.latitude, longitude = senderGeoDetails.longitude, country = senderGeoDetails.country, state = senderGeoDetails.state, city = senderGeoDetails.city\r\n| where isnotempty(latitude) and isnotempty(longitude)\r\n| extend label = strcat(\r\n iif(strlen(city) > 0, strcat(city, \", \"), \"\"),\r\n iif(strlen(state) > 0, strcat(state, \", \"), \"\"),\r\n country\r\n)\r\n| extend label = trim(\", \", label)\r\n| extend label = iif(strlen(label) > 0, label, \"N/A\")\r\n| summarize count() by tostring(latitude), tostring(longitude), label", "size": 0, "showAnalytics": true, "title": "Spam Messages by Source Country", "timeContextFromParameter": "Time_Range", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "map", "mapSettings": { "locInfo": "LatLong", "latitude": "latitude", "longitude": "longitude", "sizeSettings": "count_", "sizeAggregation": "Sum", "minData": -1, "labelSettings": "label", "legendMetric": "count_", "legendAggregation": "Sum", "itemColorSettings": { "nodeColorField": "count_", "colorAggregation": "Sum", "type": "heatmap", "heatmapPalette": "greenRed" } } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "margin": "5px", "maxWidth": "50%", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "8" }, "name": "group - 10" }, { "type": 1, "content": { "json": "#### 📝 ***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 7" } ], "fromTemplateId": "Sentinel-Mimecast-Secure-Email-Gateway-Workbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }