{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "## Security Overview\n---\n\nThis workbook contains information from your SenservaPro scanner. This will include all tenants that you manage and are included in your scanner configuration\n\n\nBelow are some metrics to help visualize the information SenservaPro collects and how it can be used for reporting.\n\n"
      },
      "name": "text - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let min_t = toscalar (ago(1d));\nlet max_t = toscalar (now());\nSenservaPro_CL\n| make-series num=count() default=0 on TimeGenerated in range(min_t, max_t, 30m) by ControlName_s\n| render timechart",
        "size": 1,
        "title": "Count of Controls Received Across All Tenants over Past 24 Hours",
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 2"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaPro_CL\r\n| summarize Total=count() by Type=Group_s\r\n| render columnchart \r\n",
        "size": 0,
        "title": "Count of Security Issues by Category Across all Tenants",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 1",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaPro_CL\r\n| where CEFLoggingLevel_d > 3\r\n| summarize count() by ControlName_s\r\n| top 10 by ControlName_s\r\n| render piechart ",
        "size": 0,
        "title": "Count of Top Security Controls Across All Tenants (Warning Severity or Higher))",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 0",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaPro_CL\r\n| summarize Total_Controls=dcount(ControlName_s) by TenantId=TenantId_s, Tenant_Name=TenantDisplayName_s\r\n| order by Total_Controls desc  ",
        "size": 0,
        "title": "Ranked Tenants in Need of Review by Unique Controls",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 4",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "SenservaPro_CL\r\n| summarize Total_Count=dcount(ControlName_s) by Value_s, Home_Tenant=TenantDisplayName_s\r\n| order by Total_Count desc\r\n| top 10 by Total_Count\r\n| project JSON_Data=parse_json(Value_s), Home_Tenant, Total_Count\r\n",
        "size": 0,
        "title": "Top 10 Items by Control Count",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "50",
      "name": "query - 5",
      "styleSettings": {
        "maxWidth": "50%"
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let levels=dynamic({\"0\":\"Debug\", \"1\":\"Informational\", \"2\":\"Notice\", \"3\":\"Warning\", \"4\":\"Errors\", \"5\":\"High\", \"6\":\"Alert\", \"7\":\"Emergency\"});\r\nSenservaPro_CL\r\n| order by CEFLoggingLevel_d\r\n| project TimeGenerated, Control_Name=ControlName_s, Severity=levels[tostring(toint(CEFLoggingLevel_d))], Senserva_Tags=Value_s, Description=Description_s\r\n| render table ",
        "size": 0,
        "title": "Controls Ordered By Severity",
        "timeContext": {
          "durationMs": 86400000
        },
        "showExportToExcel": true,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let min_t = toscalar (ago(1d));\r\nlet max_t = toscalar (now());\r\nSenservaPro_CL\r\n| where CEFLoggingLevel_d > 3\r\n| summarize ControlsNum=count() by ControlName_s, TimeGenerated\r\n| make-series ControlCount=avg(ControlsNum) default=0 on TimeGenerated in range(min_t, max_t, 1h)\r\n| render timechart",
        "size": 0,
        "title": "Average Control Count Received Over Past 24 Hours (Warning Severity or Higher)",
        "timeContext": {
          "durationMs": 86400000
        },
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "query - 7"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-SenservaProAnalyticsWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}