{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "82fedb33-961a-4199-a5ab-16340948ed10",
            "version": "KqlParameterItem/1.0",
            "name": "time_range",
            "label": "time range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 2"
    },
    {
      "type": 1,
      "content": {
        "json": "# Advanced Threat Detections"
      },
      "name": "text - 17"
    },
    {
      "type": 1,
      "content": {
        "json": "#### Detection counts for Attachment Protect, URL Protect and Impersonation Protect",
        "style": "info"
      },
      "name": "text - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "union MimecastTTPUrl_CL, MimecastTTPAttachment_CL, MimecastTTPImpersonation_CL\n| summarize Count=count() by Type, bin(TimeGenerated, 1h)",
        "size": 3,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "time_range",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart",
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "Type",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Type",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "nodeIdField": "Type",
          "sourceIdField": "Count",
          "targetIdField": "Type",
          "graphOrientation": 3,
          "showOrientationToggles": false,
          "nodeSize": null,
          "staticNodeSize": 100,
          "colorSettings": null,
          "hivesMargin": 5
        },
        "chartSettings": {
          "seriesLabelSettings": [
            {
              "seriesName": "MimecastTTPUrl_CL",
              "label": "URL Protect"
            },
            {
              "seriesName": "MimecastTTPAttachment_CL",
              "label": "Attachment Protect"
            },
            {
              "seriesName": "MimecastTTPImpersonation_CL",
              "label": "Impersonation Protect"
            }
          ]
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "Count",
          "sizeAggregation": "Sum",
          "legendMetric": "Count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "Count",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "name": "query - 8"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "# URL Protect"
            },
            "name": "text - 15"
          },
          {
            "type": 1,
            "content": {
              "json": "#### Malicious URL Detections",
              "style": "info"
            },
            "name": "text - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by Type, bin(TimeGenerated, 1h)\n",
              "size": 3,
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "graphSettings": {
                "type": 0
              },
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "MimecastTTPUrl_CL",
                    "label": "URL Protect"
                  }
                ]
              },
              "mapSettings": {
                "locInfo": "LatLong"
              }
            },
            "name": "query - 11"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Targeted Recipients",
                          "style": "info"
                        },
                        "name": "text - 8"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by userEmailAddress_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 4"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "top 10 targeted recipients ",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Senders of Malicious URLs",
                          "style": "info"
                        },
                        "name": "text - 7"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where TimeGenerated > ago(100d) and scanResult_s == \"malicious\" and action_s != \"allow\"\n| summarize count() by fromUserEmailAddress_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 6"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "top 10 senders",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Malicious URLs",
                          "style": "info"
                        },
                        "name": "text - 7"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by url_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "sortBy": [],
                          "chartSettings": {
                            "group": "url_s",
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 8"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "top 10 urls",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 1"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Advanced  Phishing Results - Credential Theft Brands",
                          "style": "info"
                        },
                        "name": "text - 9"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| extend advancedPhishingResult_CredentialTheftBrands = column_ifexists(\"advancedPhishingResult_CredentialTheftBrands_s\",\"\")\n| where scanResult_s == \"malicious\" and advancedPhishingResult_CredentialTheftBrands != \"\"\n| summarize count() by advancedPhishingResult_CredentialTheftBrands",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "gridSettings": {
                            "sortBy": [
                              {
                                "itemKey": "advancedPhishingResult_CredentialTheftTags_s",
                                "sortOrder": 1
                              }
                            ]
                          },
                          "sortBy": [
                            {
                              "itemKey": "advancedPhishingResult_CredentialTheftTags_s",
                              "sortOrder": 1
                            }
                          ]
                        },
                        "name": "query - 10"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "top 10 cred theft brand",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Advanced Phishing Results - Credential Theft Evidence",
                          "style": "info"
                        },
                        "name": "text - 11"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and advancedPhishingResult_CredentialTheftEvidence_s !=\"\"\n| summarize count() by advancedPhishingResult_CredentialTheftEvidence_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "tileSettings": {
                            "showBorder": false
                          },
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 12"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "top 10 cred theft evidence",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Advanced Phishing Result - Credential Theft Tags",
                          "style": "info"
                        },
                        "name": "text - 13"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and advancedPhishingResult_CredentialTheftTags_s !=\"\"\n| summarize count() by advancedPhishingResult_CredentialTheftTags_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "gridSettings": {
                            "hierarchySettings": {
                              "treeType": 1,
                              "groupBy": [
                                "advancedPhishingResult_CredentialTheftTags_s"
                              ]
                            },
                            "labelSettings": [
                              {
                                "columnId": "advancedPhishingResult_CredentialTheftTags_s",
                                "label": "Credential Theft Tags"
                              },
                              {
                                "columnId": "url_s",
                                "label": "URLs"
                              },
                              {
                                "columnId": "count_",
                                "label": "Occurences"
                              }
                            ]
                          }
                        },
                        "name": "query - 14"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Credential Theft Tags",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 2"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 URL Protect Definitions",
                          "style": "info"
                        },
                        "name": "text - 15"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and ttpDefinition_s !=\"\"\n| summarize count() by ttpDefinition_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 16"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "URL Protect Definitions",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 URL Protect Actions",
                          "style": "info"
                        },
                        "name": "text - 17"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and action_s !=\"\"\n| summarize count() by action_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 18"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "URL Protect Actions",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Admin Over-rides",
                          "style": "info"
                        },
                        "name": "text - 20"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and adminOverride_s !=\"N/A\"\n| summarize count() by adminOverride_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 19"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Admin Over-rides",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 3"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 User Over-rides",
                          "style": "info"
                        },
                        "name": "text - 21"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\" and userOverride_s !=\"None\"\n| summarize count() by userOverride_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart"
                        },
                        "name": "query - 22"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "User Over-rides",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Categories",
                          "style": "info"
                        },
                        "name": "text - 23"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by Category",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 24"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Categories",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Sending IP Addresses",
                          "style": "info"
                        },
                        "name": "text - 25"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by sendingIp_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "group": "sendingIp_s",
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 26"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Sending IP Addresses",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 4"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 User Awareness Action",
                          "style": "info"
                        },
                        "name": "text - 28"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by userAwarenessAction_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 27"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "User Awareness Action",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Internal Email Protect Mitigations by Actions",
                          "style": "info"
                        },
                        "name": "text - 29"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by actions_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 30"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Internal Email Protect",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Email Subjects Containing Malicious URLs",
                          "style": "info"
                        },
                        "name": "text - 32"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPUrl_CL\n| where scanResult_s == \"malicious\"\n| summarize count() by subject_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 31"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Email Subjects Containing Malicious URLs",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 5"
          }
        ]
      },
      "name": "group - 8"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "# Attachment Protect"
            },
            "name": "text - 17"
          },
          {
            "type": 1,
            "content": {
              "json": "#### Malicious Attachment Detections",
              "style": "info"
            },
            "name": "text - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastTTPAttachment_CL \n| where result_s != \"safe\"\n| summarize count() by Type, bin(TimeGenerated, 1h)\n",
              "size": 3,
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "MimecastTTPAttachment_CL",
                    "label": "Attachment Protect"
                  }
                ]
              }
            },
            "name": "query - 13"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Recipients of Malicious Attachments",
                          "style": "info"
                        },
                        "name": "text - 3"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by recipientAddress_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 4"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Recipients of Malicious Attachments",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Senders of Malicious Attachments",
                          "style": "info"
                        },
                        "name": "text - 5"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s <> \"safe\"\n| summarize count() by senderAddress_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 6"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Senders of Malicious Attachments",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Protectection Actions Triggered",
                          "style": "info"
                        },
                        "name": "text - 7"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by actionTriggered_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 8"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Protectection Actions Triggered",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 1"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Malicious Attachment File Mime Types",
                          "style": "info"
                        },
                        "name": "text - 9"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by fileType_s\n\n\n\n\n\n\n\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 10"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Malicious Attachment File Mime Types",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Attachment Event Results",
                          "style": "info"
                        },
                        "name": "text - 11"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by result_s\n\n\n\n\n\n\n\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 12"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Attachment Event Results",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Attachment Protect Event Details",
                          "style": "info"
                        },
                        "name": "text - 14"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by details_s\n\n\n\n\n\n\n\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart"
                        },
                        "name": "query - 13"
                      }
                    ]
                  },
                  "customWidth": "33",
                  "name": "Attachment Protect Event Details",
                  "styleSettings": {
                    "maxWidth": "33%"
                  }
                }
              ]
            },
            "name": "dounts group 2"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Subjects for Emails Containing Malicious Attachments ",
                          "style": "info"
                        },
                        "name": "text - 15"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by subject_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 16"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": "Subjects for Emails",
                  "styleSettings": {
                    "maxWidth": "50%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Top 10 Malicious Sha256 File Hashes",
                          "style": "info"
                        },
                        "name": "text - 17"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPAttachment_CL\n| where result_s != \"safe\"\n| summarize count() by fileHash_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 18"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": "Malicious Sha256 File Hashes",
                  "styleSettings": {
                    "maxWidth": "50%"
                  }
                }
              ]
            },
            "name": "dounts group 3"
          }
        ]
      },
      "name": "group - 7"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "# Impersonation Protect"
            },
            "name": "text - 16"
          },
          {
            "type": 1,
            "content": {
              "json": "#### Impersonation Detections",
              "style": "info"
            },
            "name": "text - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "MimecastTTPImpersonation_CL\n| where  taggedMalicious_b == true\n| summarize count() by Type, bin(TimeGenerated, 1h)\n",
              "size": 3,
              "timeContext": {
                "durationMs": 2592000000
              },
              "timeContextFromParameter": "time_range",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "categoricalbar",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "count_",
                    "label": "Impersonation Protect"
                  }
                ]
              }
            },
            "name": "query - 12"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "## Top 10 Recipients of Impersonation Emails\n"
                        },
                        "name": "text - 4"
                      },
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Recipients targeted with impersonation emails",
                          "style": "info"
                        },
                        "name": "text - 13"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPImpersonation_CL\n| where  taggedMalicious_b == true\n| summarize count() by recipientAddress_s",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 7"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": "Recipients of Impersonation Emails",
                  "styleSettings": {
                    "maxWidth": "50"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "## Top 10 Senders of Impersonation Emails\n"
                        },
                        "name": "text - 5"
                      },
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Senders that trigged Impersonation Protect events",
                          "style": "info"
                        },
                        "name": "text - 12"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPImpersonation_CL\n| where  taggedMalicious_b == true and TimeGenerated > ago(100d)\n| summarize count() by senderAddress_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 6"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": "Senders of Impersonation Emails",
                  "styleSettings": {
                    "maxWidth": "50%"
                  }
                }
              ]
            },
            "name": "donuts group 1"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## Top 10 Impersonation Events\n"
                  },
                  "name": "text - 8"
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Grouped by Impersonation Result",
                          "style": "info"
                        },
                        "name": "text - 11"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPImpersonation_CL\n| where  taggedMalicious_b == true\n| summarize count() by impersonationResults_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "sortBy": [],
                          "tileSettings": {
                            "showBorder": false,
                            "titleContent": {
                              "columnMatch": "recipientAddress_s",
                              "formatter": 1
                            },
                            "leftContent": {
                              "columnMatch": "count_",
                              "formatter": 12,
                              "formatOptions": {
                                "palette": "auto"
                              },
                              "numberFormat": {
                                "unit": 17,
                                "options": {
                                  "maximumSignificantDigits": 3,
                                  "maximumFractionDigits": 2
                                }
                              }
                            }
                          },
                          "graphSettings": {
                            "type": 0,
                            "topContent": {
                              "columnMatch": "TenantId",
                              "formatter": 1
                            },
                            "centerContent": {
                              "columnMatch": "hits_d",
                              "formatter": 1,
                              "numberFormat": {
                                "unit": 17,
                                "options": {
                                  "maximumSignificantDigits": 3,
                                  "maximumFractionDigits": 2
                                }
                              }
                            }
                          },
                          "chartSettings": {
                            "yAxis": [
                              "count_"
                            ],
                            "group": "impersonationResults_s",
                            "createOtherGroup": 10
                          },
                          "mapSettings": {
                            "locInfo": "LatLong",
                            "sizeSettings": "count_",
                            "sizeAggregation": "Sum",
                            "legendMetric": "count_",
                            "legendAggregation": "Sum",
                            "itemColorSettings": {
                              "type": "heatmap",
                              "colorAggregation": "Sum",
                              "nodeColorField": "count_",
                              "heatmapPalette": "greenRed"
                            }
                          }
                        },
                        "name": "query - 3"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": " Impersonation Events",
                  "styleSettings": {
                    "maxWidth": "50%"
                  }
                },
                {
                  "type": 12,
                  "content": {
                    "version": "NotebookGroup/1.0",
                    "groupType": "editable",
                    "items": [
                      {
                        "type": 1,
                        "content": {
                          "json": "#### Grouped by Impersonation Identifiers",
                          "style": "info"
                        },
                        "name": "text - 9"
                      },
                      {
                        "type": 3,
                        "content": {
                          "version": "KqlItem/1.0",
                          "query": "MimecastTTPImpersonation_CL\n| where  taggedMalicious_b == true\n| summarize count() by identifiers_s\n",
                          "size": 3,
                          "timeContext": {
                            "durationMs": 2592000000
                          },
                          "timeContextFromParameter": "time_range",
                          "queryType": 0,
                          "resourceType": "microsoft.operationalinsights/workspaces",
                          "visualization": "piechart",
                          "chartSettings": {
                            "createOtherGroup": 10
                          }
                        },
                        "name": "query - 10"
                      },
                      {
                        "type": 12,
                        "content": {
                          "version": "NotebookGroup/1.0",
                          "groupType": "editable",
                          "items": []
                        },
                        "name": "group - 4"
                      }
                    ]
                  },
                  "customWidth": "50",
                  "name": " Impersonation Identifiers",
                  "styleSettings": {
                    "maxWidth": "50%"
                  }
                }
              ]
            },
            "name": "dounts group 2"
          }
        ]
      },
      "name": "group - 6"
    }
  ],
  "fromTemplateId": "sentinel-MimecastTTP",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}