{
    "version": "Notebook/1.0",
    "items": [
      {
        "type": 1,
        "content": {
          "json": "This workbook leverages a function app to make an API call to Illumio Health API. \nThe function app has the context of the onprem deployment to which api call has to be made.\n\nSome of the widgets also use Syslog table to visualize data.",
          "style": "info"
        },
        "name": "text - 7"
      },
      {
        "type": 9,
        "content": {
          "version": "KqlParameterItem/1.0",
          "parameters": [
            {
              "id": "f0562353-928f-41f0-875c-99eb0f95fa38",
              "version": "KqlParameterItem/1.0",
              "name": "Illumio_Health",
              "label": "Illumio Health",
              "type": 1,
              "isRequired": true,
              "query": "{\"version\":\"CustomEndpoint/1.0\",\"data\":null,\"headers\":[],\"method\":\"GET\",\"url\":\"https://azureonprempcehealth.azurewebsites.net/api/pce_onprem_http_trigger\",\"contentType\":\"text/plain\",\"urlParams\":[],\"transformers\":null}",
              "isHiddenWhenLocked": true,
              "timeContext": {
                "durationMs": 86400000
              },
              "queryType": 10
            },
            {
              "id": "2a4639d7-a9c8-4e65-8bd7-26b97d813f6d",
              "version": "KqlParameterItem/1.0",
              "name": "TimeRange",
              "type": 4,
              "isRequired": true,
              "typeSettings": {
                "selectableValues": [
                  {
                    "durationMs": 1800000
                  },
                  {
                    "durationMs": 3600000
                  },
                  {
                    "durationMs": 14400000
                  },
                  {
                    "durationMs": 43200000
                  },
                  {
                    "durationMs": 86400000
                  },
                  {
                    "durationMs": 259200000
                  },
                  {
                    "durationMs": 604800000
                  }
                ],
                "allowCustom": true
              },
              "value": {
                "durationMs": 259200000
              }
            }
          ],
          "style": "above",
          "queryType": 0,
          "resourceType": "microsoft.operationalinsights/workspaces"
        },
        "name": "parameters - 2"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]\n| project ClusterStatus = strcat(toupper(substring(json.status, 0, 1)), substring(json.status, 1))\n",
                "size": 1,
                "title": "Cluster Status",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "stat",
                "statSettings": {
                  "valueAggregation": "None",
                  "colorSettings": {
                    "type": "static",
                    "mode": "background",
                    "heatmapPalette": "greenRed",
                    "thresholdsGrid": []
                  },
                  "iconSettings": {
                    "thresholdsGrid": []
                  },
                  "tagText": "",
                  "valueFontStyle": "mega"
                },
                "textSettings": {
                  "style": "bignumber"
                }
              },
              "customWidth": "50",
              "name": "query - 2",
              "styleSettings": {
                "showBorder": true
              }
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]['nodes'][0]\n| project json.runlevel",
                "size": 1,
                "title": "Cluster Runlevel ",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "stat",
                "statSettings": {
                  "valueAggregation": "None",
                  "colorSettings": {
                    "type": "static",
                    "mode": "background",
                    "heatmapPalette": "greenRed",
                    "thresholdsGrid": []
                  },
                  "iconSettings": {
                    "thresholdsGrid": []
                  },
                  "tagText": "",
                  "valueFontStyle": "mega"
                },
                "textSettings": {
                  "style": "bignumber"
                }
              },
              "customWidth": "50",
              "name": "query - 3",
              "styleSettings": {
                "showBorder": true
              }
            }
          ]
        },
        "name": "group - 1"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print nodes = todynamic('{Illumio_Health}')[0]['nodes']\n| mv-expand nodes\n| project  Services_Running = array_length(nodes['services']['running'])\n\n\n",
                "size": 1,
                "title": "Running Services",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "stat",
                "gridSettings": {
                  "formatters": [
                    {
                      "columnMatch": "Services_Running",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "success",
                            "text": "{0}{1}"
                          }
                        ],
                        "customColumnWidthSetting": "45ch"
                      }
                    },
                    {
                      "columnMatch": "Services_Stopped",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "3",
                            "text": "{0}{1}"
                          }
                        ],
                        "customColumnWidthSetting": "45ch"
                      }
                    },
                    {
                      "columnMatch": "Services_Partial",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "warning",
                            "text": "{0}{1}"
                          }
                        ],
                        "customColumnWidthSetting": "45ch"
                      }
                    },
                    {
                      "columnMatch": "services_running",
                      "formatter": 18,
                      "formatOptions": {
                        "thresholdsOptions": "icons",
                        "thresholdsGrid": [
                          {
                            "sourceColumn": "services_stopped",
                            "representation": "3",
                            "text": "{0}{1}"
                          },
                          {
                            "sourceColumn": "services_partial",
                            "representation": "2",
                            "text": "{0}{1}"
                          },
                          {
                            "operator": "Default",
                            "thresholdValue": null,
                            "representation": "success",
                            "text": "{0}{1}"
                          }
                        ],
                        "customColumnWidthSetting": "45ch"
                      }
                    }
                  ]
                },
                "tileSettings": {
                  "titleContent": {
                    "columnMatch": "hostname"
                  },
                  "leftContent": {
                    "columnMatch": "services_running"
                  },
                  "rightContent": {
                    "columnMatch": "services_stopped"
                  },
                  "secondaryContent": {
                    "columnMatch": "services_partial"
                  },
                  "showBorder": false
                },
                "graphSettings": {
                  "type": 0
                },
                "statSettings": {
                  "valueAggregation": "None",
                  "colorSettings": {
                    "type": "static",
                    "mode": "foreground",
                    "staticColor": "green",
                    "heatmapPalette": "greenRed",
                    "thresholdsGrid": []
                  },
                  "iconSettings": {
                    "thresholdsGrid": []
                  },
                  "tagText": "",
                  "valueFontStyle": "mega"
                }
              },
              "customWidth": "33.33",
              "name": "query - 2",
              "styleSettings": {
                "showBorder": true
              }
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print nodes = todynamic('{Illumio_Health}')[0]['nodes']\n| mv-expand nodes\n| project  Services_stopped = coalesce(array_length(nodes['services']['stopped']), 0)\n\n\n",
                "size": 1,
                "title": "Stopped Services",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "stat",
                "statSettings": {
                  "valueAggregation": "None",
                  "colorSettings": {
                    "type": "static",
                    "mode": "foreground",
                    "staticColor": "redBright",
                    "heatmapPalette": "greenRed",
                    "thresholdsGrid": []
                  },
                  "iconSettings": {
                    "thresholdsGrid": []
                  },
                  "tagText": "",
                  "valueFontStyle": "mega"
                }
              },
              "customWidth": "33.33",
              "name": "query - 1",
              "styleSettings": {
                "showBorder": true
              }
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print nodes = todynamic('{Illumio_Health}')[0]['nodes']\n| mv-expand nodes\n| project  Services_partial = coalesce(array_length(nodes['services']['partial']), 0)\n\n\n",
                "size": 1,
                "title": "Partial Services",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "stat",
                "statSettings": {
                  "valueAggregation": "None",
                  "colorSettings": {
                    "type": "static",
                    "mode": "foreground",
                    "staticColor": "gray",
                    "heatmapPalette": "greenRed",
                    "thresholdsGrid": []
                  },
                  "iconSettings": {
                    "thresholdsGrid": []
                  },
                  "tagText": "",
                  "valueFontStyle": "mega"
                }
              },
              "customWidth": "33",
              "name": "query - 2",
              "styleSettings": {
                "showBorder": true
              }
            }
          ]
        },
        "name": "service stats"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "title": "Node Status",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print nodes = todynamic('{Illumio_Health}')[0]['nodes']\n| mv-expand nodes\n| project Hostname = nodes['hostname'], Runlevel = nodes['runlevel'], IpAddress = nodes['ip_address']\n\n\n",
                "size": 3,
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "table",
                "gridSettings": {
                  "formatters": [
                    {
                      "columnMatch": "Hostname",
                      "formatter": 0,
                      "formatOptions": {
                        "customColumnWidthSetting": "15ch"
                      }
                    }
                  ]
                },
                "tileSettings": {
                  "titleContent": {
                    "columnMatch": "Hostname",
                    "formatter": 1,
                    "tooltipFormat": {
                      "tooltip": "Hostname"
                    }
                  },
                  "leftContent": {
                    "columnMatch": "Runlevel",
                    "formatter": 12,
                    "formatOptions": {
                      "palette": "blue"
                    },
                    "tooltipFormat": {
                      "tooltip": "Runlevel"
                    }
                  },
                  "secondaryContent": {
                    "columnMatch": "IpAddress",
                    "formatter": 12,
                    "formatOptions": {
                      "palette": "blue"
                    },
                    "tooltipFormat": {
                      "tooltip": "Ip Address"
                    }
                  },
                  "showBorder": true,
                  "size": "full"
                }
              },
              "customWidth": "100",
              "name": "query - 0"
            }
          ]
        },
        "name": "node_status"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "title": "Disk Latency (in milliseconds)",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "Syslog\n| where SyslogMessage has 'illumio_pce/system_health' and SyslogMessage has 'src=disk_latency' and SyslogMessage has 'disk=Traffic'\n| extend traffic_disk_latency_milliseconds = toint(extract(@\"traffic_disk_latency_milliseconds=(\\d+)\", 1, SyslogMessage))\n",
                "size": 0,
                "aggregation": 3,
                "title": "Traffic Disk",
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "barchart",
                "chartSettings": {
                  "xAxis": "TimeGenerated",
                  "yAxis": [
                    "traffic_disk_latency_milliseconds"
                  ],
                  "seriesLabelSettings": [
                    {
                      "seriesName": "153035ad-fede-495a-b6c2-6d4308689f79",
                      "label": "Latency in milliseconds"
                    }
                  ],
                  "customThresholdLine": "300",
                  "customThresholdLineStyle": 5,
                  "xSettings": {
                    "label": "Time"
                  },
                  "ySettings": {
                    "label": "Traffic Disk Latency"
                  }
                }
              },
              "customWidth": "50",
              "name": "query - 0"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "Syslog\n| where SyslogMessage has 'illumio_pce/system_health' and SyslogMessage has 'src=disk_latency' and SyslogMessage has 'disk=Policy'\n| extend policy_disk_latency_milliseconds = toint(extract(@\"policy_disk_latency_milliseconds=(\\d+)\", 1, SyslogMessage))\n",
                "size": 0,
                "aggregation": 3,
                "title": "Policy Disk",
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "barchart",
                "chartSettings": {
                  "xAxis": "TimeGenerated",
                  "yAxis": [
                    "policy_disk_latency_milliseconds"
                  ],
                  "seriesLabelSettings": [
                    {
                      "seriesName": "153035ad-fede-495a-b6c2-6d4308689f79",
                      "label": "Latency in milliseconds"
                    }
                  ],
                  "customThresholdLine": "300",
                  "customThresholdLineStyle": 5
                }
              },
              "customWidth": "50",
              "name": "query - 1"
            }
          ]
        },
        "name": "group - 4"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "title": "Traffic Ingestion Stats",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "Syslog\n| where SyslogMessage has 'illumio_pce/system_health'\n| extend \n    collector_flows = iif(SyslogMessage has 'src=collector', toint(extract(@\"collector_summaries_per_second=(\\d+)\", 1, SyslogMessage)), 0),\n    traffic_flows = iif(SyslogMessage has 'src=flow_analytics', toint(extract(@\"traffic_summaries_per_second=(\\d+)\", 1, SyslogMessage)), 0)\n| summarize \n    collector_flows = sum(collector_flows), \n    traffic_flows = sum(traffic_flows) \n    by bin(TimeGenerated, 10m)  // Adjust bin size (e.g., 1m for minutes, 5m, etc.)\n| order by TimeGenerated asc\n",
                "size": 3,
                "aggregation": 3,
                "title": "Traffic Flow Ingestion Rate (Average)",
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "linechart",
                "chartSettings": {
                  "xAxis": "TimeGenerated",
                  "yAxis": [
                    "collector_flows",
                    "traffic_flows"
                  ]
                }
              },
              "customWidth": "50",
              "name": "query - 0"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "Syslog\n| where SyslogMessage has 'illumio_pce/system_health' and SyslogMessage has 'src=flow_analytics'\n| extend traffic_summaries_per_second = todouble(extract(@\"traffic_summaries_per_second=([\\d\\.]+)\", 1, SyslogMessage))\n| extend traffic_backlog_utilization_percentage = todouble(extract(@\"traffic_backlog_utilization_percentage=([\\d\\.]+)\", 1, SyslogMessage))\n| extend traffic_database_size_gb = todouble(extract(@\"traffic_database_size_gb=([\\d\\.]+)\", 1, SyslogMessage))\n| extend traffic_database_utilization_percentage = todouble(extract(@\"traffic_database_utilization_percentage=([\\d\\.]+)\", 1, SyslogMessage))\n| extend traffic_database_size_days = todouble(extract(@\"traffic_database_size_days=([\\d\\.]+)\", 1, SyslogMessage))\n| project TimeGenerated, traffic_summaries_per_second, traffic_backlog_utilization_percentage, traffic_database_size_gb, traffic_database_utilization_percentage, traffic_database_size_days",
                "size": 3,
                "aggregation": 3,
                "title": "Traffic Backlog vs Traffic DB Utilization",
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces",
                "visualization": "linechart",
                "chartSettings": {
                  "xAxis": "TimeGenerated",
                  "yAxis": [
                    "traffic_backlog_utilization_percentage",
                    "traffic_database_utilization_percentage"
                  ]
                }
              },
              "customWidth": "50",
              "name": "query - 1"
            }
          ]
        },
        "name": "group - 5"
      },
      {
        "type": 12,
        "content": {
          "version": "NotebookGroup/1.0",
          "groupType": "editable",
          "items": [
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]\n| mv-expand group = parsejson(json.groups)\n| extend components = group.components\n| mv-expand section = parsejson(components)\n| where section['section'] == 'VEN Heartbeat'\n| mv-expand node = section.contents[0].cluster\n| mv-expand node_metrics = node.metrics\n| project NodeAddress = node.node, Metric = node_metrics['metric'], MetricValue = node_metrics['entries'][0]['values'][0]['value']",
                "size": 3,
                "title": "VEN Heartbeat Stats",
                "timeContextFromParameter": "TimeRange",
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
              },
              "customWidth": "50",
              "name": "query - 0"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]\n| mv-expand group = parsejson(json.groups)\n| extend components = group.components\n| mv-expand section = parsejson(components)\n| where section['section'] == 'VEN Policy'\n| mv-expand node = section.contents[0].cluster\n| mv-expand node_metrics = node.metrics\n| project NodeAddress = node.node, Metric = node_metrics['metric'], MetricValue = node_metrics['entries'][0]['values'][0]['value']",
                "size": 3,
                "title": "VEN Policy Stats",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
              },
              "customWidth": "50",
              "name": "query - 1"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]\n| mv-expand group = parsejson(json.groups)\n| extend components = group.components\n| mv-expand section = parsejson(components)\n| where section['section'] == 'Policy Database Summary'\n| mv-expand content = section.contents\n| project  Metric = content['metric'], MetricValue = content['entries'][0]['values'][0]['value'], Unit = coalesce(content['entries'][0]['values'][0]['unit'], '')",
                "size": 0,
                "title": "Policy Database Summary",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
              },
              "customWidth": "50",
              "name": "query - 2"
            },
            {
              "type": 3,
              "content": {
                "version": "KqlItem/1.0",
                "query": "print json = todynamic('{Illumio_Health}')[0]\n| mv-expand group = parsejson(json.groups)\n| extend components = group.components\n| mv-expand section = parsejson(components)\n| where section['section'] == 'Traffic Database Summary'\n| mv-expand content = section.contents\n| project  Metric = content['metric'], MetricValue = content['entries'][0]['values'][0]['value'], Unit = coalesce(content['entries'][0]['values'][0]['unit'], '')",
                "size": 0,
                "title": "Traffic Database Summary",
                "timeContext": {
                  "durationMs": 86400000
                },
                "queryType": 0,
                "resourceType": "microsoft.operationalinsights/workspaces"
              },
              "customWidth": "50",
              "name": "query - 3"
            }
          ]
        },
        "name": "group - 6"
      }
    ],
    "fromTemplateId": "sentinel-OnPremHealthWorkbook",
    "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
  }