{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "Welcome to your CTERA workbook.  This area will display relevant graphs and metrics for the CTERA workspace.\n\n\nWe've included relevant graphs of your SMB audit logs collected from the selected filers."
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "\tSyslog\r\n\t| where ProcessName == 'gw-audit'\r\n\t| extend\r\n\t   TenantName = extract(\"(\\\"vportal\\\":\\\"[^\\\"]*\\\")\", 1, SyslogMessage),\r\n\t   UserName = extract(\"(user=[^|]*)\", 1, SyslogMessage)\r\n\t| extend Permission = extract(\"(op=[^|]*)\", 1, SyslogMessage)\r\n    | where Permission matches regex @\"(?i).*denied.*\" or Permission == \"op=delete\" // Regex pattern to filter denied operations\r\n    | summarize Count = count() by Permission",
        "size": 1,
        "title": "Denied Operations and Deletions Count",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Permission",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "name": "query - 1 (Denied Operations and Deletions Count)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "\tSyslog\r\n\t| where ProcessName == 'gw-audit'\r\n\t| extend user = extract(\"user=([^|]*)\", 1, SyslogMessage)\r\n\t| extend operation = extract(\"op=([^|]*)\", 1, SyslogMessage)\r\n    | where operation matches regex @\"(?i).*denied.*\"\r\n\t| summarize operation_count=count() by bin(TimeGenerated, 1m), user\r\n\t| project TimeGenerated, user, operation_count\r\n",
        "size": 0,
        "title": "Denied Operations Count per User",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "linechart"
      },
      "name": "query - 2 (Denied Operations per User)"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "\tSyslog\r\n\t| where SyslogMessage contains \"ctera_audit\" and SyslogMessage contains \"op=delete\"\r\n\t| extend user = extract(\"user=([^|]*)\", 1, SyslogMessage)\r\n\t| extend timestamp = extract(\"timestamp=([^|]*)\", 1, SyslogMessage)\r\n\t| extend TimeGenerated = todatetime(timestamp)\r\n\t| summarize deletion_count = count() by bin(TimeGenerated, 1m), user\r\n\t| where deletion_count > 1\r\n| project TimeGenerated, user, deletion_count",
        "size": 1,
        "title": "Deleted Operations per User",
        "timeContext": {
          "durationMs": 2592000000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "name": "query - 3 (Deleted Operation)"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "2941ad84-e8df-4f19-b360-bae6cd104f2f",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}