Azure-Sentinel/Workbooks/VisualizationDemo.json

{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Text, Grids, Tiles",
            "subTarget": "Text",
            "preText": "",
            "style": "link"
          },
          {
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Charts and Graphs",
            "subTarget": "Charts",
            "style": "link"
          },
          {
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Time Brushing",
            "subTarget": "TB",
            "style": "link"
          },
          {
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Dynamic Content",
            "subTarget": "DC",
            "style": "link"
          },
          {
            "cellValue": "Tab",
            "linkTarget": "parameter",
            "linkLabel": "Personalization",
            "subTarget": "Personalization",
            "style": "link"
          }
        ]
      },
      "name": "links - 1"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "This is an example of text being put in a workbook. This workbook shows different types of visualizations that can be achieved in Sentinel workbooks."
            },
            "name": "text - 0"
          },
          {
            "type": 9,
            "content": {
              "version": "KqlParameterItem/1.0",
              "parameters": [
                {
                  "id": "a39e8bae-dd20-4c06-85ca-83cea33a1fa2",
                  "version": "KqlParameterItem/1.0",
                  "name": "TimeParameter",
                  "label": "Time Parameter",
                  "type": 4,
                  "isRequired": true,
                  "value": {
                    "durationMs": 86400000
                  },
                  "typeSettings": {
                    "selectableValues": [
                      {
                        "durationMs": 300000
                      },
                      {
                        "durationMs": 900000
                      },
                      {
                        "durationMs": 1800000
                      },
                      {
                        "durationMs": 3600000
                      },
                      {
                        "durationMs": 14400000
                      },
                      {
                        "durationMs": 43200000
                      },
                      {
                        "durationMs": 86400000
                      },
                      {
                        "durationMs": 172800000
                      },
                      {
                        "durationMs": 259200000
                      },
                      {
                        "durationMs": 604800000
                      },
                      {
                        "durationMs": 1209600000
                      },
                      {
                        "durationMs": 2419200000
                      },
                      {
                        "durationMs": 2592000000
                      },
                      {
                        "durationMs": 5184000000
                      },
                      {
                        "durationMs": 7776000000
                      }
                    ]
                  },
                  "resourceType": "microsoft.insights/components"
                }
              ],
              "style": "pills",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "parameters - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| take 20",
              "size": 0,
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeParameter",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "query - 2"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "Usage\r\n| summarize count() by DataType\r\n| sort by count_ desc",
              "size": 0,
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeParameter",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "tiles",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "DataType",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "count_",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "name": "query - 3"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "Text"
      },
      "name": "TGT"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| summarize count() by ProductName, bin(TimeGenerated,1d)",
              "size": 0,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "categoricalbar"
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| summarize count() by ProductName, bin(TimeGenerated,1d)",
              "size": 0,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart"
            },
            "customWidth": "33",
            "name": "query - 4"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| summarize count() by ProductName, bin(TimeGenerated,1d)",
              "size": 0,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "linechart"
            },
            "customWidth": "66",
            "name": "query - 5"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| summarize count() by ProductName",
              "size": 0,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "graph",
              "graphSettings": {
                "type": 2,
                "topContent": {
                  "columnMatch": "ProductName",
                  "formatter": 1,
                  "formatOptions": {
                    "showIcon": true
                  }
                },
                "centerContent": {
                  "columnMatch": "count_",
                  "formatter": 1,
                  "formatOptions": {
                    "showIcon": true
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                },
                "hivesContent": {
                  "columnMatch": "ProductName",
                  "formatter": 1,
                  "formatOptions": {
                    "showIcon": true
                  }
                },
                "nodeIdField": "ProductName",
                "nodeSize": null,
                "staticNodeSize": 100,
                "colorSettings": {
                  "nodeColorField": "ProductName",
                  "type": 1,
                  "colorPalette": "pastel"
                },
                "groupByField": "ProductName",
                "hivesMargin": 5
              }
            },
            "name": "query - 3"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "Charts"
      },
      "name": "Charts"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| where TimeGenerated >= ago(90d)\r\n| summarize count() by ProductName, bin(TimeGenerated,1d)",
              "size": 0,
              "title": "Time Brushing Example",
              "timeBrushParameterName": "TimeBrush",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "timechart"
            },
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n",
              "size": 0,
              "timeContext": {
                "durationMs": 0
              },
              "timeContextFromParameter": "TimeBrush",
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "query - 1"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "TB"
      },
      "name": "TB"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityAlert\r\n| extend Resource = ResourceId\r\n| summarize count() by Resource\r\n| sort by count_ desc\r\n",
              "size": 0,
              "title": "Machines with Alerts",
              "timeContext": {
                "durationMs": 2592000000
              },
              "exportMultipleValues": true,
              "exportedParameters": [
                {
                  "fieldName": "Resource",
                  "parameterName": "Resource"
                }
              ],
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "filter": true
              }
            },
            "customWidth": "25",
            "name": "query - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "let Resource_ = dynamic({Resource});\r\nSecurityAlert\r\n| where ResourceId contains tostring(Resource_)\r\n| project TimeGenerated, Resource_, AlertName, AlertSeverity, ProductName\r\n",
              "size": 0,
              "title": "Alerts per Resource",
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "customWidth": "75",
            "conditionalVisibility": {
              "parameterName": "Resource",
              "comparison": "isNotEqualTo"
            },
            "name": "query - 6"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "DC"
      },
      "name": "DC"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityRecommendation\r\n| where RecommendationState contains 'unhealthy'\r\n| extend Link = strcat('http://', RecommendationLink)\r\n| project AssessedResourceId, RecommendationName, RecommendationState, RecommendationSeverity, Link",
              "size": 0,
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces"
            },
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "SecurityRecommendation\r\n| where RecommendationState contains 'unhealthy'\r\n| extend Link = strcat('http://', RecommendationLink)\r\n| project AssessedResourceId, RecommendationName, RecommendationState, RecommendationSeverity, Link",
              "size": 0,
              "timeContext": {
                "durationMs": 2592000000
              },
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "gridSettings": {
                "formatters": [
                  {
                    "columnMatch": "RecommendationSeverity",
                    "formatter": 18,
                    "formatOptions": {
                      "thresholdsOptions": "colors",
                      "thresholdsGrid": [
                        {
                          "operator": "==",
                          "thresholdValue": "High",
                          "representation": "redBright",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "==",
                          "thresholdValue": "Medium",
                          "representation": "yellow",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "==",
                          "thresholdValue": "Low",
                          "representation": "blue",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "==",
                          "thresholdValue": "Informational",
                          "representation": "gray",
                          "text": "{0}{1}"
                        },
                        {
                          "operator": "Default",
                          "thresholdValue": null,
                          "representation": "blue",
                          "text": "{0}{1}"
                        }
                      ]
                    }
                  },
                  {
                    "columnMatch": "Link",
                    "formatter": 7,
                    "formatOptions": {
                      "linkTarget": "GenericDetails",
                      "linkIsContextBlade": true
                    }
                  }
                ],
                "labelSettings": [
                  {
                    "columnId": "AssessedResourceId",
                    "label": "Resource"
                  },
                  {
                    "columnId": "RecommendationName",
                    "label": "Recommendation"
                  },
                  {
                    "columnId": "RecommendationState",
                    "label": "Status"
                  },
                  {
                    "columnId": "RecommendationSeverity",
                    "label": "Severity"
                  },
                  {
                    "columnId": "Link"
                  }
                ]
              }
            },
            "name": "query - 5"
          }
        ]
      },
      "conditionalVisibility": {
        "parameterName": "Tab",
        "comparison": "isEqualTo",
        "value": "Personalization"
      },
      "name": "Personalization"
    }
  ],
  "styleSettings": {},
  "fromTemplateId": "sentinel-VisualizationDemo",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}