{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "8e13e573-459e-4b44-9ea5-11d5bd20f420", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "NordPass Admin Panel Activity", "subTarget": "Admin", "style": "link" }, { "id": "f2781409-9e42-42b8-84a2-5b54e2785cef", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "NordPass Vault Activity", "subTarget": "Vault", "style": "link" }, { "id": "9b03ae0c-1a15-4a24-962c-d41559dc55bf", "cellValue": "SelectedTab", "linkTarget": "parameter", "linkLabel": "NordPass Logins & Vault Access", "subTarget": "Logins", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3ac5bb66-88db-4682-be8e-ff1ae0bdfe3c", "version": "KqlParameterItem/1.0", "name": "AdminActions", "type": 9, "multiSelect": true, "quote": "'", "delimiter": ",", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "value": [ "access.item_reassignment_transferred", "access.recovery_request_approved", "access.recovery_request_created", "access.recovery_request_declined", "access.user_email_updated", "access.user_status_updated", "billing.payment_method_change_started", "domain.domain_added", "domain.domain_deleted", "domain.domain_verified", "totp.global_settings_updated", "global_settings.global_settings_updated", "global_settings.mfa_reset", "global_settings.password_policy_toggled", "global_settings.password_policy_updated", "integrations.activities_token_created", "integrations.activities_token_revoked", "integrations.vanta_integration_disabled", "integrations.vanta_integration_enabled", "invites.invite_converted_to_provisioned", "invites.invite_link_generated", "invites.user_approved", "invites.user_converted_to_provisioned", "invites.user_invite_accepted", "invites.user_invite_declined", "invites.user_invite_removed", "invites.user_invite_resent", "invites.user_invited", "invites.whitelisted_domains_updated", "item_delete.item_reassignment_deleted", "oauth_credentials.oauth_credentials_created", "oauth_credentials.oauth_credentials_deleted", "oauth_credentials.oauth_credentials_updated", "oauth_domain.oauth_domain_created", "oauth_domain.oauth_domain_deleted", "oauth_domain.oauth_domain_verified", "roles.user_role_updated", "scim_credentials.scim_credentials_created", "scim_credentials.scim_credentials_deleted", "scim_credentials.scim_credentials_recreated", "totp.2fa_reset_in_ecp", "sharing_hub.item_viewed", "sharing_hub.viewed", "sharing_hub.item_access_revealed", "access.extend_trial_organization", "checkout.change_credit_card_failure", "checkout.change_credit_card_success", "checkout.renewal_success", "checkout.trial_to_subscription", "checkout.upgrade", "checkout.upsell", "domain.domain_reverification_failed", "domain.domain_reverified", "domain.domain_verification_failed", "domain.domain_verification_restarted", "global_settings.global_settings_customization_deleted", "group_provisioning.group_provisioning_disabled", "group_provisioning.group_provisioning_enabled", "groups.group_created", "groups.group_updated", "groups.group_users_added", "groups.group_users_removed", "groups.groups_deleted", "role_settings.password_policy_toggled", "role_settings.password_policy_updated", "role_settings.role_settings_cleared", "role_settings.role_settings_updated", "user_settings.user_settings_cleared", "user_settings.user_settings_updated", "consents.organization_consent_given", "consents.organization_consent_revoked", "breach.breach_report_viewed", "domain.domain_added_auto", "breach.domain_breached", "breach.breach_details_viewed", "breach.breach_unresolved", "breach.breach_resolved", "breach.user_muted", "breach.user_unmuted", "role_settings.role_settings_deleted", "oauth_token_management.all_tokens_deleted", "oauth_token_management.token_deleted", "invites.invite_status_updated" ] }, { "id": "2659b909-a29c-482b-9226-b82150e8a543", "version": "KqlParameterItem/1.0", "name": "AdminTimeFilter", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "d6827134-bd11-46b8-9b96-3c0e39a7ef90", "version": "KqlParameterItem/1.0", "name": "AdminActionFilter", "label": "Actions", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {AdminTimeFilter:start} and EventTime <= {AdminTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({AdminActions})\n| summarize Count = count() by action\n| order by Count desc\n| project action", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "c6e7299f-c921-4a9a-ade1-846f58fe5821", "version": "KqlParameterItem/1.0", "name": "AdminUserFilter", "label": "Users", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {AdminTimeFilter:start} and EventTime <= {AdminTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({AdminActions})\n| extend user = coalesce(user_email, initiator)\n| summarize Count = count() by user\n| order by Count desc\n| project user", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let adminActionsSelected = dynamic([{AdminActionFilter}]);\nlet adminUsersSelected = dynamic([{AdminUserFilter}]);\n\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend Action = action\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where strcat(event_type, \".\", action) in ({AdminActions})\n| where action in (adminActionsSelected)\n| where user in (adminUsersSelected)\n| where EventTime >= {AdminTimeFilter:start} and EventTime <= {AdminTimeFilter:end}\n| summarize Count = count() by action\n| project-rename Action = action\n| order by Count desc\n", "size": 0, "title": "Actions", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "xAxis": "action", "yAxis": [ "Count" ], "showMetrics": false } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let adminActionsSelected = dynamic([{AdminActionFilter}]);\nlet adminUsersSelected = dynamic([{AdminUserFilter}]);\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {AdminTimeFilter:start} and EventTime <= {AdminTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({AdminActions})\n| where action in (adminActionsSelected)\n| where user in (adminUsersSelected)\n| summarize Count = count() by user\n| order by Count desc\n| project-rename User = user\n", "size": 0, "title": "Actions count by user", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "xAxis": "user_email", "yAxis": [ "Count" ], "showMetrics": false } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "Admin" }, "name": "AdminTab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9b70034a-caea-46c8-b095-3b394a11155d", "version": "KqlParameterItem/1.0", "name": "VaultActions", "type": 9, "multiSelect": true, "quote": "'", "delimiter": ",", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "VaultTimeFilter", "value": [ "item_access.item_viewed", "item_access.2fa_item_accessed", "totp.2fa_item_accessed", "item_access.item_autofilled", "item_access.item_copied", "item_access.item_moved_to_shared_folder", "item_access.item_secret_viewed", "item_access.items_created", "item_access.items_imported", "item_access.items_updated", "item_access.vault_exported", "item_access.items_imported_v2", "item_delete.items_deleted", "item_share.external_items_received", "item_share.item_acl_changed", "item_share.item_new_ttl_set", "item_share.item_owner_changed", "item_share.item_time_limited_share_expired", "item_share.items_shared", "item_share.items_unshared", "item_share.shared_folder_shared", "item_share.shared_folder_unshared", "password_health.item_created_reused", "password_health.item_created_weak", "password_health.item_updated_reused", "password_health.item_updated_weak", "password_health.items_imported_reused", "password_health.items_imported_weak", "totp.2fa_added_to_item", "totp.2fa_device_deleted", "totp.2fa_device_enrolled", "totp.2fa_item_created", "totp.2fa_removed_from_item", "item_access.deleted_item_copied", "item_access.deleted_item_viewed", "consents.user_consent_given", "item_access.deleted_item_autofilled", "item_share.item_accepted", "item_access.deleted_item_secret_viewed", "consents.user_consent_revoked", "breach.email_breached", "item_share.item_rejected", "redeem.redeem_granted", "redeem.redeem_removed" ] }, { "id": "341446e6-d6d0-45b0-a85d-bd18974012c6", "version": "KqlParameterItem/1.0", "name": "VaultTimeFilter", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "VaultTimeFilter", "label": "Time Range" }, { "id": "34c229d8-282e-4dbf-a11c-530596b9367c", "version": "KqlParameterItem/1.0", "name": "VaultActionFilter", "label": "Actions", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {VaultTimeFilter:start} and EventTime <= {VaultTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({VaultActions})\n| summarize Count = count() by action\n| order by Count desc\n| project action", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "95c8917b-dbe1-4119-823e-69f46e9c7e8e", "version": "KqlParameterItem/1.0", "name": "VaultUserFilter", "label": "Users", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {VaultTimeFilter:start} and EventTime <= {VaultTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({VaultActions})\n| extend user = coalesce(user_email, initiator)\n| summarize Count = count() by user\n| order by Count desc\n| project user", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let vaultActionsSelected = dynamic([{VaultActionFilter}]);\nlet vaultUsersSelected = dynamic([{VaultUserFilter}]);\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {VaultTimeFilter:start} and EventTime <= {VaultTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({VaultActions})\n| where action in (vaultActionsSelected)\n| where user in (vaultUsersSelected)\n| summarize Count = count() by action\n| project-rename Action = action\n| order by Count desc\n", "size": 0, "title": "Item actions", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "yAxis": [ "Count" ] } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let vaultActionsSelected = dynamic([{VaultActionFilter}]);\nlet vaultUsersSelected = dynamic([{VaultUserFilter}]);\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {VaultTimeFilter:start} and EventTime <= {VaultTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({VaultActions})\n| where action in (vaultActionsSelected)\n| where user in (vaultUsersSelected)\n| extend platform = tostring(parse_json(metadata).platform)\n| summarize Count = count() by platform\n| project-rename Platform = platform\n| order by Count desc", "size": 0, "title": "Item actions by platform", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "yAxis": [ "Count" ] } }, "customWidth": "50", "name": "query - 3", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "Vault" }, "name": "VaultTab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "49c0e02b-eeb3-4c5e-8d37-3c5969f141ea", "version": "KqlParameterItem/1.0", "name": "LoginActions", "type": 9, "multiSelect": true, "quote": "'", "delimiter": ",", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "value": [ "lock.master_validated", "login.user_login_failed", "login.user_login_successful", "biometric.biometric_disabled", "biometric.biometric_enabled", "lock.master_changed", "lock.master_failed", "password.business_account_password_change_failed", "password.business_account_password_change_successful", "password.password_reset_requested", "password.password_reset_successful", "recovery_code.recovery_copied", "recovery_code.recovery_created", "recovery_code.recovery_downloaded", "recovery_code.recovery_reset", "recovery_code.recovery_used", "password.business_account_password_reset_successful", "password.business_account_password_reset_requested" ] }, { "id": "2ad69ff4-ac95-45e8-a6ed-35a044ada95b", "version": "KqlParameterItem/1.0", "name": "LoginTimeFilter", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 86400000 }, "typeSettings": { "selectableValues": [ { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 } }, { "id": "42229fe6-c3fd-47a7-941c-077ed71805e3", "version": "KqlParameterItem/1.0", "name": "LoginActionFilter", "label": "Actions", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {LoginTimeFilter:start} and EventTime <= {LoginTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({LoginActions})\n| summarize Count = count() by action\n| order by Count desc\n| project action\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, { "id": "96a06759-9b2e-44d4-8b62-e2ad0624dd07", "version": "KqlParameterItem/1.0", "name": "LoginUserFilter", "label": "Users", "type": 2, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "NordPassEventLogs_CL \n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {LoginTimeFilter:start} and EventTime <= {LoginTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({LoginActions})\n| extend user = coalesce(user_email, initiator)\n| summarize Count = count() by user\n| order by Count desc\n| project user\n", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let loginActionsSelected = dynamic([{LoginActionFilter}]);\nlet loginUsersSelected = dynamic([{LoginUserFilter}]);\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {LoginTimeFilter:start} and EventTime <= {LoginTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({LoginActions})\n| where action in (loginActionsSelected)\n| where user in (loginUsersSelected)\n| summarize Count = count() by action\n| project-rename Action = action\n| order by Count desc", "size": 0, "title": "Login access ", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "yAxis": [ "Count" ] } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "margin": "5px", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let loginActionsSelected = dynamic([{LoginActionFilter}]);\nlet loginUsersSelected = dynamic([{LoginUserFilter}]);\nNordPassEventLogs_CL \n| extend user = coalesce(user_email, initiator)\n| extend EventTime = unixtime_seconds_todatetime(timestamp)\n| where EventTime >= {LoginTimeFilter:start} and EventTime <= {LoginTimeFilter:end}\n| where strcat(event_type, \".\", action) in ({LoginActions})\n| where action in (loginActionsSelected)\n| where user in (loginUsersSelected)\n| extend platform = tostring(parse_json(metadata).platform)\n| summarize Count = count() by platform\n| project-rename Platform = platform\n| order by Count desc", "size": 0, "title": "By platform", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Count", "formatter": 3, "formatOptions": { "min": 0, "palette": "categorical" } } ] }, "chartSettings": { "yAxis": [ "Count" ] } }, "customWidth": "50", "name": "query - 2", "styleSettings": { "margin": "5px", "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "SelectedTab", "comparison": "isEqualTo", "value": "Logins" }, "name": "LoginsTab" } ], "styleSettings": {}, "fromTemplateId": "NordPass", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }