{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Microsoft Exchange Admin Activity\r\n\r\nThis workbook helps you visualize what is happening in your Exchange environment.\r\nResults removed :\r\n\t- All Test-* and Set-AdServerSetting Cmdlets"
      },
      "name": "text - 2"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "3792117c-d924-4ec7-a327-1e8d5e9f291a",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time Range",
            "type": 4,
            "isRequired": true,
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            },
            "value": {
              "durationMs": 2592000000
            }
          },
          {
            "id": "743317e2-ebcf-4958-861d-4ff97fc7cce1",
            "version": "KqlParameterItem/1.0",
            "name": "EnvironmentList",
            "label": "Environment",
            "type": 2,
            "isRequired": true,
            "query": "ExchangeAdminAuditLogs | where TimeGenerated {TimeRange}\r\n | summarize by ESIEnvironment",
            "typeSettings": {
              "showDefault": false
            },
            "queryType": 0,
            "resourceType": "microsoft.operationalinsights/workspaces"
          },
          {
            "id": "8ac96eb3-918b-4a36-bcc4-df50d8f46175",
            "version": "KqlParameterItem/1.0",
            "name": "Help",
            "label": "Show Help",
            "type": 10,
            "isRequired": true,
            "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n { \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }\\r\\n]\\r\\n\"}",
            "timeContext": {
              "durationMs": 2592000000
            },
            "queryType": 8
          }
        ],
        "style": "above",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "TimeRange"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "34188faf-7a02-4697-9b36-2afa986afc0f",
            "cellValue": "selected",
            "linkTarget": "parameter",
            "linkLabel": "Cmdlet Analysis",
            "subTarget": "Cmdlet",
            "postText": "t",
            "style": "link",
            "icon": "3",
            "linkIsContextBlade": true
          },
          {
            "id": "be02c735-6150-4b6e-a386-b2b023e754e5",
            "cellValue": "selected",
            "linkTarget": "parameter",
            "linkLabel": "Active Directory Modifications",
            "subTarget": "AD",
            "style": "link"
          }
        ]
      },
      "name": "links - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Cmdlet summary",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "This tab parses the events from Admin Audit logs :\r\n\r\n- list of cmdlets\r\n- filter on a VIP and/or Sensitive objects (based on Watchlist \"Exchange VIP\" and \" Monitored Exchange Cmdlets\")\r\n- anomalies detections are based on the KQL function series_decompose_anomalies",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "CmdletGroupHelp"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "5a942eba-c991-4b84-9a94-c153bca86e12",
                  "version": "KqlParameterItem/1.0",
                  "name": "VIPOnly",
                  "label": "Show VIP Only",
                  "type": 10,
                  "isRequired": true,
                  "typeSettings": {
                    "showDefault": false
                  },
                  "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\"},\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]",
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "83befa26-eee0-49ab-9785-72653943bc6b",
                  "version": "KqlParameterItem/1.0",
                  "name": "SensitiveOnly",
                  "label": "Sensitive CmdLet Only",
                  "type": 10,
                  "isRequired": true,
                  "typeSettings": {
                    "showDefault": false
                  },
                  "jsonData": "[\r\n { \"value\": \"True\", \"label\": \"Yes\" },\r\n { \"value\": \"True,False\", \"label\": \"No\", \"selected\":true }\r\n]\r\n",
                  "timeContext": {
                    "durationMs": 86400000
                  }
                },
                {
                  "id": "a6046096-a14b-4023-af1a-ab47f4e2dff1",
                  "version": "KqlParameterItem/1.0",
                  "name": "CallerFilter1",
                  "label": "Caller",
                  "type": 2,
                  "multiSelect": true,
                  "quote": "'",
                  "delimiter": ",",
                  "query": "ExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| distinct Caller",
                  "isHiddenWhenLocked": true,
                  "typeSettings": {
                    "showDefault": false
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                },
                {
                  "id": "4c896211-577a-4390-b85a-6f9ac18f2824",
                  "version": "KqlParameterItem/1.0",
                  "name": "CmdletFilter1",
                  "type": 2,
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| distinct CmdletName",
                  "isHiddenWhenLocked": true,
                  "typeSettings": {
                    "showDefault": false
                  },
                  "timeContext": {
                    "durationMs": 86400000
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                }
              ],
              "style": "above",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 0"
          },
          {
            "type": 1,
            "content": {
              "json": "This section show all the Cmdlets executed in the selected time range. Possible filters are: \r\n- **VIP Only selected** Cmdlets used against VIP objects (based on the \"Exchange VIP\" watchlist)\r\n- **Sensitive Cmdlets** Cmdlets considered as Sensitive (based on the \"Monitored Exchange Cmdlets\" watchlist)\r\n\r\nThese informations can be useful to detect unexpected behaviors or to determine what are the action performed by the accounts (ie. service accounts).\r\n\r\nℹ️ It is recommended to delegated only the necessary privileges to an account.",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "CmdtListHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n//| where TargetObject !contains \"Health\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| sort by count_",
              "size": 2,
              "showAnalytics": true,
              "title": "List of all executed cmdlets during the last 90 days (based on Sentinel retention)",
              "exportFieldName": "CmdletName",
              "exportParameterName": "CmdletFilter",
              "exportDefaultValue": "\"\"",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "CmdletName",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "graphSettings": {
                "type": 0,
                "topContent": {
                  "columnMatch": "CmdletName",
                  "formatter": 1
                },
                "centerContent": {
                  "columnMatch": "count_",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "chartSettings": {
                "createOtherGroup": 20
              }
            },
            "customWidth": "45",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n | where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n//| where TargetObject !contains \"Health\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize count() by CmdletName\r\n| join kind=leftouter ( ExchangeAdminAuditLogs \r\n    | where TimeGenerated > ago(30d)\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | where Status == \"Success\"\r\n    //| where TargetObject !contains \"Health\"\r\n    | where CmdletName  !in (ExcludedCmdlet)\r\n    | where IsVIP in ({VIPOnly})\r\n    | where IsSensitive in ({SensitiveOnly})\r\n    | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by CmdletName\r\n    | extend Anomalies=series_decompose_anomalies(Count)\r\n) on CmdletName\r\n| project CmdletName, Total=count_, Count, Anomalies\r\n| sort by Total",
              "size": 2,
              "showAnalytics": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "CmdletName",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "31.5ch"
                    }
                  },
                  {
                    "columnMatch": "Total",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "9.3ch"
                    }
                  },
                  {
                    "columnMatch": "Count",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "330px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "Anomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "redBright",
                      "customColumnWidthSetting": "330px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "labelSettings": [
                  {
                    "columnId": "CmdletName",
                    "label": "Cmdlet"
                  },
                  {
                    "columnId": "Count",
                    "label": "Count for the last 30 days"
                  }
                ]
              }
            },
            "customWidth": "55",
            "name": "CmdletTrends"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n//| where TargetObject !contains \"Health\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| summarize Total = count() by Caller\r\n| join kind=leftouter ( ExchangeAdminAuditLogs \r\n    | where TimeGenerated > ago(30d)\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | where Status == \"Success\"\r\n    | where IsVIP in ({VIPOnly})\r\n    | where IsSensitive in ({SensitiveOnly})\r\n    | make-series Count=count() on TimeGenerated from ago(30d) to now() step 1d by Caller\r\n    | extend Anomalies=series_decompose_anomalies(Count)\r\n) on Caller\r\n| project Caller, Total, Count, Anomalies\r\n| sort by Total desc",
              "size": 1,
              "showAnalytics": true,
              "exportFieldName": "Caller",
              "exportParameterName": "CallerFilter",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Caller",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "70ch"
                    }
                  },
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "125px"
                    }
                  },
                  {
                    "columnMatch": "Count",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "300px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "Anomalies",
                    "formatter": 10,
                    "formatOptions": {
                      "palette": "redBright",
                      "customColumnWidthSetting": "300px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "sortBy": [
                  {
                    "itemKey": "$gen_bar_Total_1",
                    "sortOrder": 2
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "Count",
                    "label": "Count for the last 30 days"
                  }
                ]
              },
              "sortBy": [
                {
                  "itemKey": "$gen_bar_Total_1",
                  "sortOrder": 2
                }
              ],
              "chartSettings": {
                "createOtherGroup": 20
              }
            },
            "name": "query - 4"
          },
          {
            "type": 1,
            "content": {
              "json": "## List of Cmdlets\r\nYou can pick a tile in the list of all executed cmdlets above to filter the list.\r\n\r\nBy default all accounts found in the log are displayed.\r\n\r\nSelect an account in the previous section, to display on Cmdlets launched by this user\r\n\r\n> **Legend**    \r\n>    \r\n> 👑 VIP user    \r\n> 💥 Sensitive action\r\n\r\nIf needed, select an item in the dropdownlist. Dropdownlist are independent."
            },
            "name": "text - 3"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "008273d1-a013-4d86-9e23-499e5175a85e",
                  "version": "KqlParameterItem/1.0",
                  "name": "CallerFilter",
                  "label": "Caller",
                  "type": 2,
                  "multiSelect": true,
                  "quote": "'",
                  "delimiter": ",",
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| distinct Caller\r\n| sort by Caller asc",
                  "typeSettings": {
                    "additionalResourceOptions": [
                      "value::all"
                    ],
                    "showDefault": false
                  },
                  "defaultValue": "value::all",
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces",
                  "value": [
                    "value::all"
                  ]
                },
                {
                  "id": "21bd4e45-65ca-4b9b-a19c-177d6b37d807",
                  "version": "KqlParameterItem/1.0",
                  "name": "TargetObjectFilter",
                  "label": "Target Object",
                  "type": 2,
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| distinct TargetObject\r\n| sort by TargetObject asc",
                  "typeSettings": {
                    "showDefault": false
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                },
                {
                  "id": "9e93d5c3-0fcb-4ece-b2a0-fc3ff44a0b04",
                  "version": "KqlParameterItem/1.0",
                  "name": "CmdletFilter",
                  "label": "Cmdlet Filter",
                  "type": 2,
                  "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n| distinct CmdletName\r\n| sort by CmdletName asc",
                  "typeSettings": {
                    "showDefault": false
                  },
                  "queryType": 0,
                  "resourceType": "microsoft.operationalinsights/workspaces"
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 8"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ExcludedCmdlet = externaldata (Cmdlet:string)[h\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Solutions/Microsoft%20Exchange%20Security%20-%20Exchange%20On-Premises/%23%20-%20General%20Content/Operations/Watchlists/ExcludedCmdletWatchlist.csv\"]with(format=\"csv\",ignoreFirstRecord=true)| project Cmdlet;\r\nlet CallerF = toscalar(split(\"{CallerFilter}\",\",\"));\r\nExchangeAdminAuditLogs\r\n| where TimeGenerated {TimeRange}\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Status == \"Success\"\r\n//| where TargetObject !contains \"Health\"\r\n| where CmdletName  !in (ExcludedCmdlet)\r\n| where IsVIP in ({VIPOnly})\r\n| where IsSensitive in ({SensitiveOnly})\r\n//| parse \"{CallerFilter}\" with \",\" CallerF\r\n//| where Caller contains {CallerFilter} and TargetObject contains \"{TargetObjectFilter}\" and CmdletName contains \"{CmdletFilter}\"\r\n| where (Caller in ({CallerFilter}) or Caller == \"ALL\")  and TargetObject contains \"{TargetObjectFilter}\" and CmdletName contains \"{CmdletFilter}\"\r\n| extend ActualCmdLet = strcat( CmdletName, \" \", CmdletParameters)\r\n| extend TargetObject = iif(IsVIP == true and TargetObject !=\"\" , strcat(\"👑 \",TargetObject), TargetObject )\r\n| extend ActualCmdLet = iif(IsSensitive == true and TargetObject !=\"\", strcat(\"💥 \",ActualCmdLet), ActualCmdLet )\r\n| project TimeGenerated, Caller, TargetObject, ActualCmdLet\r\n| sort by TimeGenerated desc",
              "size": 2,
              "showAnalytics": true,
              "title": "History",
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "ActualCmdLet",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "120ch"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 5"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "Cmdlet"
      },
      "name": "Cmdlet Group"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## VIP modifications\r\n\r\nThis view allows you to quickly see what is happening on VIP accounts.\r\n**This tab needs Option 2 or 3**"
            },
            "name": "text - 3"
          },
          {
            "type": 1,
            "content": {
              "json": "This section displays the modifications on VIP Active Directory objects for the selected Time Range.\r\n\r\nIt is based on the security events 4725, 4726, 4738, 4740 and 4767.",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "HelpTotalModifVIP"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ImportantADActivities = dynamic([4725,4726,4738,4740,4767]);\r\nlet Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nlet VIPUsers = _GetWatchlist('ExchangeVIP') | summarize make_list(tostring(sAMAccountName)) ;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange}\r\n| where EventID in (ImportantADActivities)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where SubjectUserName in (VIPUsers) or TargetUserName in (VIPUsers)\r\n| extend Activity = tostring(split(Activity,\"- \")[1])\r\n| summarize Count=count() by Activity",
              "size": 3,
              "noDataMessage": "Sections related to Option 2 or 3",
              "noDataMessageStyle": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Activity",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "showBorder": false,
                "size": "auto"
              }
            },
            "name": "QueryVIPModif"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let ImportantADActivities = dynamic([4725,4726,4738,4740,4767]);\r\nlet Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nlet VIPUsers = _GetWatchlist('ExchangeVIP') | summarize make_list(tostring(sAMAccountName)) ;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange}\r\n| where EventID in (ImportantADActivities)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where SubjectUserName in (VIPUsers) or TargetUserName in (VIPUsers)\r\n| extend Activity = split(Activity,\"- \")[1]\r\n| extend SubjectUserName = iif( SubjectUserName in (VIPUsers), strcat(SubjectUserName, \" 👑\"), SubjectUserName)\r\n| extend SubjectUserName = iif( SubjectUserName hassuffix \"$\", strcat(\"💻 \", SubjectUserName), strcat(\"👨‍💼 \", SubjectUserName))\r\n| extend TargetUserName = iif( TargetUserName in (VIPUsers), strcat(TargetUserName, \" 👑\"), TargetUserName)\r\n| project TimeGenerated, Activity, SubjectUserName,TargetUserName\r\n| order by TimeGenerated desc",
              "size": 0,
              "showAnalytics": true,
              "noDataMessage": "Sections related to Option 2 or 3",
              "noDataMessageStyle": 2,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "Activity",
                    "formatter": 0,
                    "formatOptions": {
                      "customColumnWidthSetting": "75ch"
                    }
                  }
                ],
                "rowLimit": 10000,
                "filter": true,
                "labelSettings": [
                  {
                    "columnId": "TimeGenerated",
                    "label": "Time"
                  },
                  {
                    "columnId": "SubjectUserName",
                    "label": "Operator"
                  },
                  {
                    "columnId": "TargetUserName",
                    "label": "Target"
                  }
                ]
              }
            },
            "name": "query - 2"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "AD"
      },
      "name": "AdModifSummary"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Server activity summary",
        "items": [
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "04d09365-30ba-4bb1-9e76-06fc7b97ea71",
                  "version": "KqlParameterItem/1.0",
                  "name": "ComputerFilter",
                  "type": 1,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 5"
          },
          {
            "type": 1,
            "content": {
              "json": "This tab parses the events from the System and Security event logs of the Exchange servers. You can use it for the following activities:\r\n\r\n- Track the Exchange services status (based on the event 7036 and on the watchlist \"Exchange Services Monitoring\")\r\n- Track logons on the servers (this excludes network logons)\r\n- Track creations, modifications and delegation actions of local user accounts",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "ServersHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange:value}\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| summarize count() by Computer",
              "size": 4,
              "title": "Security Events per Exchange Servers",
              "exportFieldName": "Computer",
              "exportParameterName": "ComputerFilter",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Computer"
                },
                "subtitleContent": {
                  "columnMatch": "count_",
                  "formatter": 4,
                  "formatOptions": {
                    "min": 2000,
                    "palette": "blue"
                  },
                  "numberFormat": {
                    "unit": 0,
                    "options": {
                      "style": "decimal"
                    }
                  }
                },
                "showBorder": true,
                "sortCriteriaField": "Computer",
                "sortOrderField": 1,
                "size": "auto"
              }
            },
            "customWidth": "100",
            "name": "ExServersListTiles"
          },
          {
            "type": 1,
            "content": {
              "json": "## List of monitored services changes"
            },
            "name": "text - 7"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nlet ExchangeServices = _GetWatchlist('ExchangeServicesMonitoring') | summarize make_list(DisplayName);\r\nEvent \r\n| where TimeGenerated {TimeRange:value}\r\n| where EventID == 7036\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Computer like \"{ComputerFilter}\"\r\n| where WindowsService_CF in (ExchangeServices)\r\n| extend ServiceNewState_CF = iif( ServiceNewState_CF == \"stopped\", strcat(\"🔴 \",ServiceNewState_CF), strcat(\"🟢 \",ServiceNewState_CF))\r\n| project TimeGenerated, Computer, WindowsService_CF, ServiceNewState_CF\r\n| sort by TimeGenerated desc",
              "size": 0,
              "showAnalytics": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "table",
              "showExpandCollapseGrid": true,
              "gridSettings": {
                "labelSettings": [
                  {
                    "columnId": "WindowsService_CF",
                    "label": "Service"
                  },
                  {
                    "columnId": "ServiceNewState_CF",
                    "label": "State"
                  }
                ]
              }
            },
            "name": "ListServicesState"
          },
          {
            "type": 1,
            "content": {
              "json": "Details of logon on the Exchange servers (or the selected server from the tiles above).\r\n\r\nThis parses the security event 4624 on Exchange servers.\r\n\r\nThis uses the following filters:\r\n- LogonType <> 3 (Network)\r\n- AccountType <> \"Machine\"\r\n- TargetUserName !hasprefix \"HealthMailbox\"\r\n- Account !hasprefix \"Window Manager\"",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "ServerLogonHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange:value}\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Computer like \"{ComputerFilter}\"\r\n| where EventID == 4624\r\n| where LogonType <> 3\r\n| where AccountType <> \"Machine\" \r\n| where TargetUserName !hasprefix \"HealthMailbox\"\r\n| where Account !hasprefix \"Window Manager\"\r\n| summarize count() by LogonTypeName",
              "size": 0,
              "title": "Logon Type statistics",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "25",
            "name": "DetailsLogonEventsPie"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange:value}\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Computer like \"{ComputerFilter}\"\r\n| where EventID == 4624\r\n| where LogonType <> 3\r\n| where AccountType <> \"Machine\" \r\n| where TargetUserName !hasprefix \"HealthMailbox\"\r\n| where Account !hasprefix \"Window Manager\"\r\n| project TimeGenerated, Computer,  Account, IpAddress, LogonTypeName\r\n| sort by TimeGenerated desc",
              "size": 0,
              "showAnalytics": true,
              "showExportToExcel": true,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "75",
            "name": "DetailsLogonEvents"
          },
          {
            "type": 1,
            "content": {
              "json": "Details of local account activities on the Exchange servers (or the selected server from the tiles above). It parses the following security events:\r\n- 4720 Account creation\r\n- 4724 Password reset\r\n- 4722 Account enabled\r\n- 4725 Account disabled\r\n- 4726 Account deleted",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "name": "LocalAccountActivityHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange:value}\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Computer like \"{ComputerFilter}\"\r\n| where EventID in (4720,4724,4722,4725,4726)\r\n| extend Action = case(EventID == 4720, \"🆕 Account creation\", EventID == 4724, \"🔄 Password reset\", EventID == 4722, \"🟢 Account enabled\", EventID == 4725, \"🔴 Account disabled\",\"❌ Account deleted\")\r\n| summarize count() by Action",
              "size": 0,
              "showAnalytics": true,
              "showExportToExcel": true,
              "title": "List of local account activities",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "25",
            "name": "LocalAccountActivity"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent\r\n| where TimeGenerated {TimeRange:value}\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| where Computer like \"{ComputerFilter}\"\r\n| where EventID in (4720,4724,4722,4725,4726)\r\n| extend Action = case(EventID == 4720, \"🆕 Account creation\", EventID == 4724, \"🔄 Password reset\", EventID == 4722, \"🟢 Account enabled\", EventID == 4725, \"🔴 Account disabled\",\"❌ Account deleted\")\r\n| project TimeGenerated, Computer, Action, SubjectAccount, TargetAccount",
              "size": 0,
              "showAnalytics": true,
              "showExportToExcel": true,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "75",
            "name": "LocalActivityGrid"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "Server"
      },
      "name": "ServerSummaryGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Mail flow",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "This is an experimental tab to search for information from the Message Tracking logs.",
              "style": "warning"
            },
            "name": "WarningMessagetracking"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MessageTracking\r\n| where TimeGenerated > ago(7d)\r\n| summarize Max = max(TimeGenerated) by Computer\r\n| extend Age = strcat( datetime_diff( \"Hour\", now(), Max) , \" hours ago\")",
              "size": 4,
              "noDataMessage": "No message tracking data for more than 7 days",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "titleContent": {
                  "columnMatch": "Computer"
                },
                "leftContent": {
                  "columnMatch": "Max"
                },
                "rightContent": {
                  "columnMatch": "Age"
                },
                "showBorder": true,
                "size": "auto"
              }
            },
            "name": "query - 1"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "69b3412d-8984-42a7-8b5a-c238462097b7",
                  "version": "KqlParameterItem/1.0",
                  "name": "Filter",
                  "type": 1,
                  "timeContext": {
                    "durationMs": 86400000
                  }
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MessageTracking\r\n| search \"*{Filter}\"\r\n| project-away $table\r\n| sort by TimeGenerated desc",
              "size": 0,
              "showAnalytics": true,
              "showExportToExcel": true,
              "noDataMessage": "No message tracking information found.",
              "timeContextFromParameter": "TimeRange",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true
              }
            },
            "name": "query - 0"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "Mail"
      },
      "name": "MailFlowGroup"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "title": "Data Statistics",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## 90-day statistics"
            },
            "name": "text - 4"
          },
          {
            "type": 1,
            "content": {
              "json": "This tabs show the data ingestions of logs used to monitor Exchange Servers activities.\r\n\r\nNote that the Event table contains all Windows event log events but the security event logs.",
              "style": "info"
            },
            "conditionalVisibility": {
              "parameterName": "Help",
              "comparison": "isEqualTo",
              "value": "Yes"
            },
            "showPin": false,
            "name": "StatsHelp"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nEvent \r\n| where TimeGenerated > ago(90d)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| summarize Total=count() by Computer\r\n| join (Event\r\n    | where TimeGenerated > ago(90d)\r\n    | extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n    | extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | make-series EventCount=count() on TimeGenerated from ago(90d) to now() step 1d by Computer\r\n    | extend EventAnomalies=series_decompose_anomalies(EventCount)\r\n) on Computer\r\n| extend Computer = strcat(\"💻 \", Computer)\r\n| project-away TimeGenerated, Computer1\r\n| sort by Total desc ",
              "size": 1,
              "showAnalytics": true,
              "showExportToExcel": true,
              "title": "Event table",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true,
                "formatters": [
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "min": 1000,
                      "palette": "blue",
                      "customColumnWidthSetting": "70px"
                    }
                  },
                  {
                    "columnMatch": "EventCount",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "EventAnomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "min": -1,
                      "max": 1,
                      "palette": "redDark",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "EventCount",
                    "label": "Count"
                  },
                  {
                    "columnId": "EventAnomalies",
                    "label": "Anomalies"
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "EventTable"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nW3CIISLog \r\n| where TimeGenerated > ago(90d)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| summarize Total=count() by Computer\r\n| join (W3CIISLog\r\n    | where TimeGenerated > ago(90d)\r\n    | extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n    | extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | make-series EventCount=count() on TimeGenerated from ago(90d) to now() step 1d by Computer\r\n    | extend EventAnomalies=series_decompose_anomalies(EventCount)\r\n) on Computer\r\n| extend Computer = strcat(\"💻 \", Computer)\r\n| project-away TimeGenerated, Computer1\r\n| sort by Total desc ",
              "size": 1,
              "showAnalytics": true,
              "showExportToExcel": true,
              "title": "W3CIISLog table",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true,
                "formatters": [
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "min": 1000,
                      "palette": "blue",
                      "customColumnWidthSetting": "70px"
                    }
                  },
                  {
                    "columnMatch": "EventCount",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "EventAnomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "min": -1,
                      "max": 1,
                      "palette": "redDark",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "EventCount",
                    "label": "Count"
                  },
                  {
                    "columnId": "EventAnomalies",
                    "label": "Anomalies"
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "IISLogs"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nSecurityEvent \r\n| where TimeGenerated > ago(90d)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| summarize Total=count() by Computer\r\n| join (SecurityEvent\r\n    | where TimeGenerated > ago(90d)\r\n    | extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n    | extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | make-series EventCount=count() on TimeGenerated from ago(90d) to now() step 1d by Computer\r\n    | extend EventAnomalies=series_decompose_anomalies(EventCount)\r\n) on Computer\r\n| extend Computer = strcat(\"💻 \", Computer)\r\n| project-away TimeGenerated, Computer1\r\n| sort by Total desc ",
              "size": 1,
              "showAnalytics": true,
              "showExportToExcel": true,
              "title": "SecurityEvent table",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true,
                "formatters": [
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "min": 1000,
                      "palette": "blue",
                      "customColumnWidthSetting": "70px"
                    }
                  },
                  {
                    "columnMatch": "EventCount",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "EventAnomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "min": -1,
                      "max": 1,
                      "palette": "redDark",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "EventCount",
                    "label": "Count"
                  },
                  {
                    "columnId": "EventAnomalies",
                    "label": "Anomalies"
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "SecurityEventTable"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let EHP = union isfuzzy=true withsource=TableName ExchangeHttpProxy, blabla*, Event | where TableName != \"Event\";\r\nlet Env = ExchangeConfiguration(SpecificSectionList=\"ESIEnvironment\")\r\n| extend DomainFQDN_ = tostring(CmdletResultValue.DomainFQDN)\r\n| project DomainFQDN_, ESIEnvironment;\r\nEHP \r\n| where TimeGenerated > ago(90d)\r\n| extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n| extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n| where ESIEnvironment in ('{EnvironmentList}')\r\n| summarize Total=count() by Computer\r\n| join (EHP\r\n    | where TimeGenerated > ago(90d)\r\n    | extend DomainEnv = replace_string(Computer,strcat(tostring(split(Computer,'.',0)[0]),'.'),'')\r\n    | join kind=leftouter  ( \r\n        Env\r\n    ) on $left.DomainEnv == $right.DomainFQDN_\r\n    | extend ESIEnvironment = iif (isnotempty(ESIEnvironment), ESIEnvironment, strcat(\"Unknown-\",DomainEnv))\r\n    | where ESIEnvironment in ('{EnvironmentList}')\r\n    | make-series EventCount=count() on TimeGenerated from ago(90d) to now() step 1d by Computer\r\n    | extend EventAnomalies=series_decompose_anomalies(EventCount)\r\n) on Computer\r\n| extend Computer = strcat(\"💻 \", Computer)\r\n| project-away TimeGenerated, Computer1\r\n| sort by Total desc ",
              "size": 1,
              "showAnalytics": true,
              "showExportToExcel": true,
              "title": "ExchangeHttpProxy table",
              "noDataMessage": "No Exchange HTTP Proxy Data",
              "noDataMessageStyle": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "rowLimit": 10000,
                "filter": true,
                "formatters": [
                  {
                    "columnMatch": "Total",
                    "formatter": 4,
                    "formatOptions": {
                      "min": 1000,
                      "palette": "blue",
                      "customColumnWidthSetting": "70px"
                    }
                  },
                  {
                    "columnMatch": "EventCount",
                    "formatter": 21,
                    "formatOptions": {
                      "palette": "blue",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Trend"
                    }
                  },
                  {
                    "columnMatch": "EventAnomalies",
                    "formatter": 9,
                    "formatOptions": {
                      "palette": "redDark",
                      "customColumnWidthSetting": "200px"
                    },
                    "tooltipFormat": {
                      "tooltip": "Anomalies"
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "EventCount",
                    "label": "Count"
                  },
                  {
                    "columnId": "EventAnomalies",
                    "label": "Anomalies"
                  }
                ]
              }
            },
            "customWidth": "50",
            "name": "ExchangeHttpProxyTable"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "selected",
        "comparison": "isEqualTo",
        "value": "Stats"
      },
      "name": "group - 7"
    }
  ],
  "fromTemplateId": "sentinel-MicrosoftExchangeSecurityMonitoring",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}