update made to clear extra changes

Workbooks/ZscalerThreats.json

@@ -91,10 +91,23 @@
         "exportFieldName": "threatname",
         "exportParameterName": "threatname",
         "exportDefaultValue": "All",
+        "exportToExcelOptions": "visible",
+        "title": "Blocked threats",
+        "timeContext": {
+          "durationMs": 0
+        },
+        "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
         "gridSettings": {
           "formatters": [
+            {
+              "columnMatch": "Threat name",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "threatname",
               "formatter": 5,
@@ -123,7 +136,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Zscaler\"\r\n| where DeviceEventClassID == \"Blocked\"\r\n| where DeviceCustomString5Label == \"threatname\" \r\n| where DeviceCustomString5 != \"None\" \r\n| where DeviceCustomString5 != \"suspiciousfile\"\r\n| where '{threatname}' == \"All\" or '{threatname}' == DeviceCustomString5 \r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), ['Threat name'] = DeviceCustomString5\r\n",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked threats over time",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -143,10 +160,23 @@
         "exportFieldName": "urlcat",
         "exportParameterName": "urlcat",
         "exportDefaultValue": "All",
+        "exportToExcelOptions": "visible",
+        "title": "Blocked URL categories",
+        "timeContext": {
+          "durationMs": 0
+        },
+        "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
         "gridSettings": {
           "formatters": [
+            {
+              "columnMatch": "urlcat",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "Count",
               "formatter": 8,
@@ -162,6 +192,10 @@
             {
               "columnId": "urlcat",
               "label": "URL categories"
+            },
+            {
+              "columnId": "Count",
+              "label": ""
             }
           ]
         }
@@ -175,7 +209,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Zscaler\"\r\n| where DeviceEventClassID contains \"Block\"\r\n| where DeviceProduct == \"NSSWeblog\" \r\n| where DeviceCustomString2 != \"\"\r\n| where '{urlcat}' == \"All\" or '{urlcat}' == DeviceCustomString2\r\n| summarize Count = count() by urlcat = DeviceCustomString2, bin(TimeGenerated, {TimeRange:grain})",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked URL categories over time",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -195,10 +233,23 @@
         "exportFieldName": "Activity",
         "exportParameterName": "Activity",
         "exportDefaultValue": "All",
+        "exportToExcelOptions": "visible",
+        "title": "Transactions blocked IPS",
+        "timeContext": {
+          "durationMs": 0
+        },
+        "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
         "gridSettings": {
           "formatters": [
+            {
+              "columnMatch": "Activity",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "Count",
               "formatter": 8,
@@ -220,7 +271,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceEventClassID == \"Blocked\"\r\n| where Activity contains \"IPS\" \r\n| where Activity == '{Activity}' or '{Activity}' == \"All\"\r\n| summarize Count = count()  by  Activity, bin(TimeGenerated, {TimeRange:grain})\r\n| order by Count desc\r\n",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Transactions blocked IPS over time",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -250,6 +305,13 @@
                 "aggregation": "Unique"
               }
             },
+            {
+              "columnMatch": "TimeGenerated",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "Count",
               "formatter": 8,
@@ -266,6 +328,13 @@
                 "showIcon": true,
                 "aggregation": "Sum"
               }
+            },
+            {
+              "columnMatch": "$gen_group",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
             }
           ],
           "filter": true,
@@ -286,17 +355,30 @@
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where SourceUserPrivileges != SourceUserName \r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\r\n| where DeviceCustomNumber1>=50\r\n| summarize Count = count() by SourceUserName, RiskScore = DeviceCustomNumber1\r\n| order by RiskScore desc, Count",
+        "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where SourceUserPrivileges != SourceUserName \r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\r\n | where DeviceCustomNumber1>=50\r\n| summarize Count = count() by SourceUserName, RiskScore = DeviceCustomNumber1\r\n| order by RiskScore desc, Count",
         "size": 0,
         "title": "Users accessing malicious destinations",
         "timeContextFromParameter": "TimeRange",
         "exportFieldName": "SourceUserName",
         "exportParameterName": "SourceUserName",
         "exportDefaultValue": "All",
+        "exportToExcelOptions": "visible",
+        "title": "Users accessing malicious destinations",
+        "timeContext": {
+          "durationMs": 0
+        },
+        "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
         "gridSettings": {
           "formatters": [
+            {
+              "columnMatch": "SourceUserName",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "RiskScore",
               "formatter": 8,
@@ -326,9 +408,13 @@
       "type": 3,
       "content": {
         "version": "KqlItem/1.0",
-        "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where SourceUserPrivileges != SourceUserName \r\n| where SourceUserName == '{SourceUserName}' or '{SourceUserName}' == \"All\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\r\n| where DeviceCustomNumber1>=50\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), SourceUserName\r\n",
+        "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where SourceUserPrivileges != SourceUserName \r\n| where SourceUserName == '{SourceUserName}' or '{SourceUserName}' == \"All\"\r\n| where DeviceCustomNumber1>=50\r\n| summarize count() by bin(TimeGenerated, {TimeRange:grain}), SourceUserName\r\n",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Users accessing malicious destinations over time",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -343,7 +429,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceVendor == \"Zscaler\"\r\n| where DeviceEventClassID == \"Blocked\"\r\n| where FileType != \"None\" \r\n| summarize count() by FileType \r\n| sort by count_  desc nulls last \r\n| top 10 by count_",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked file types",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -358,16 +448,39 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n|  where DeviceCustomString4 !=\"None\"\r\n| summarize count() by malwarecat = DeviceCustomString4",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Transactions intercepted by malware protection",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
         "visualization": "piechart",
         "gridSettings": {
+          "formatters": [
+            {
+              "columnMatch": "malwarecat",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
+            {
+              "columnMatch": "count_",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            }
+          ],
           "labelSettings": [
             {
               "columnId": "malwarecat",
               "label": "Malware Categoty"
+            },
+            {
+              "columnId": "count_"
             }
           ]
         }
@@ -381,7 +494,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1)\r\n| where DeviceCustomNumber1 != 0\r\n| where DeviceEventClassID !contains \"Allow\" \r\n| where DeviceCustomString4 !=\"None\"\r\n| where RequestMethod == \"GET\"  or  RequestMethod == \"POST\"\r\n| extend replaced= iif ( RequestMethod==\"GET\" , replace('GET', 'Inbound Threats', RequestMethod) , replace('POST', 'Outbound Threats', RequestMethod))\r\n| summarize count() by  replaced\r\n",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Inbound and outbound blocked threats",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -417,7 +534,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\" \r\n| parse AdditionalExtensions with * \"urlclass=\" urlclass \";devicemodel=\" devicemodel\r\n| where urlclass == \"Advanced Security Risk\" \r\n| summarize count() by urlcat = DeviceCustomString2",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked advanced security risk URL categories",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -432,7 +553,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where DeviceEventClassID !contains \"Allow\"\r\n|  where DeviceCustomString4 !=\"None\"\r\n| where SourceUserPrivileges == \"Road Warrior\" \r\n| summarize count() by malwarecat = DeviceCustomString4",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Threats blocked for Road Warriors",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -447,7 +572,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where DeviceCustomString3 contains \"Behavior\" \r\n| summarize count() by malwarecat = DeviceCustomString4",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Threats intercepted by Sandbox protection",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -462,7 +591,11 @@
         "version": "KqlItem/1.0",
         "query": "let data = CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\" \r\n| where DeviceEventClassID contains \"Block\"\r\n| where MaliciousIPCountry !=\"\";\r\nlet appData = data\r\n| summarize TotalCount = count() by MaliciousIPCountry\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by MaliciousIPCountry\r\n    | project-away TimeGenerated) on MaliciousIPCountry\r\n| order by TotalCount desc, MaliciousIPCountry asc\r\n| project MaliciousIPCountry, TotalCount, Trend\r\n| serialize Id = row_number();\r\ndata\r\n| summarize TotalCount = count() by Activity , MaliciousIPCountry\r\n| join kind=inner (data\r\n    | make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by MaliciousIPCountry, Activity\r\n    | project-away TimeGenerated) on MaliciousIPCountry, Activity\r\n| order by TotalCount desc, MaliciousIPCountry asc\r\n| project MaliciousIPCountry, Activity, TotalCount, Trend\r\n| serialize Id = row_number(1000000)\r\n| join kind=inner (appData) on MaliciousIPCountry\r\n| project Id, Name = Activity, Type = 'Activity', ['MaliciousIPCountry Count'] = TotalCount, Trend,  ParentId = Id1\r\n| union (appData \r\n    | project Id, Name = MaliciousIPCountry, Type = 'Operation', ['MaliciousIPCountry Count'] = TotalCount,  Trend)\r\n| order by ['MaliciousIPCountry Count'] desc, Name asc\r\n",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked destination activities, by location",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",
@@ -476,6 +609,20 @@
                 "showIcon": true
               }
             },
+            {
+              "columnMatch": "Name",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
+            {
+              "columnMatch": "Type",
+              "formatter": 0,
+              "formatOptions": {
+                "showIcon": true
+              }
+            },
             {
               "columnMatch": "MaliciousIPCountry Count",
               "formatter": 8,
@@ -519,7 +666,11 @@
         "version": "KqlItem/1.0",
         "query": "CommonSecurityLog\r\n| where DeviceProduct == \"NSSWeblog\"\r\n| where DeviceEventClassID !contains \"Allow\" \r\n| where DestinationServiceName != \"generalbrowsing\"\r\n| summarize count() by DestinationServiceName, bin(TimeGenerated, {TimeRange:grain})",
         "size": 0,
+        "exportToExcelOptions": "visible",
         "title": "Blocked cloud apps over time",
+        "timeContext": {
+          "durationMs": 0
+        },
         "timeContextFromParameter": "TimeRange",
         "queryType": 0,
         "resourceType": "microsoft.operationalinsights/workspaces",