From a7ba5a094e502f1e5488654b20fc79681d60f762 Mon Sep 17 00:00:00 2001 From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com> Date: Fri, 8 Sep 2023 09:41:57 +0530 Subject: [PATCH] updated for branding --- Solutions/KQL Training/Package/3.0.0.zip | Bin 116461 -> 116458 bytes .../Package/createUiDefinition.json | 2 +- .../KQL Training/Package/mainTemplate.json | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/KQL Training/Package/3.0.0.zip b/Solutions/KQL Training/Package/3.0.0.zip index 7b8bb88892f64c45a2b1e818fd41394a15d1e935..a4f374787211aa29356d9a72fce5f68b553e9e65 100644 GIT binary patch delta 9026 zcmV-IBfZ@1jR)$D2OCgJ0|XQR000O8Crv0Ao|oLOUy)c2GP>{+?`D(U`hFV{G1M@ zMl~U4k&=@OvoNl_`=!2%-D)w7)-v@=;{W+)`Ad?5ap+PSu73aV>&eGvlk;^5L#+lfV@^E#d z&02$Wu4pSDZU~ER;wpi)!Y)vk#6!r@`chiy7wMo@CT1U!AZY8fwVQkf4H}^~3plVu z>d4v76gELeT!n{3Xjr1kp~%UCKf&EdrGWSpIwdfAf_UxuIURoq&L6@Z&^Z*2uUHMK zL8L386HLJ+sD+irfs!`}qVP*&nGol5OuSrScx(uinS4bLek;&Q(ueSuGN&Hx&$Un+ zPw*bW!-CHi@MHOE1TT!enHh6KAJHcZ>te}FhiQzkPv(TIR*$DCyZAnOcx`L|^%eMz!9eSe=iGLvd!(v7e z%#D-Y*iBrfQ{w^7sZ&0?x6D%P+Z!tb!prAdf4KW;Fcnq(M_ zTJ^{kvvxshl`6Wdq50IBl}yW0c-5wWcA@=&azq3vPnv(qK4~Pkr5<`H)FbVN{2P7`^p$~DcOqXlB>v^3I~CNtHl;PWlcr4sVp~0y{Ys81Sf!_ z-jPt1>F}mfmCCwDUoAoju>*yA;g^Gs69>bXEgXN2j)&J#*VR-;o$mw5((tqpJ^1#r zi%gn1{4z)+`2>$aJ2^>^Oh-qpY<9%!L`_x4{)Jn`yF?l~4az!UgqtbGadmiEg0uG4YK|x9qQ||I>ZkvkZ zZnS@DL865S_l}Too}0UOdoc}(gXzygQOH98Gm#HUKn}|E7#wvI;Aj}Hn0y2k-4O16 z)eHp#Z!Uru#Lb?Xhi1Y7>7|K)bH12hDZ)zZQ?)Qr-p9{xxOKMMcpK z7Y+IpDw)<*Jh~Ugdg_+}4F~#0L`~jz-`zL5U6ec4&y+~eZ9yw%l@`|@E-0wd3%3PKIcuv=)DJxL(c1Uhu5F}oony$q5R{YKJV}8 z-OfRk2%B#)#8&&B2YFiJW&IX-4TozfqL zE8MQ?oJShhff}pDfT2QTwjzer|Awfb5qWu6UYNmV2t`hXgz&hgjl1DZsI=f^hVKut z?U&|!cg&z=IWM}S+jf{8w^moW=xQ#l^Mn65!I7s1?=i)VXtJXHt$q>4uv+|jD|u(! z3nN=?LuXuzI+oR61|5>^V9hi=(&{}S_>_LpzkdKwO9KQH0000809Q;XSG#ZAKf1mF z0NI0o2e*F*0pp^7LCDcoytZSzV&^5tsg&(f2EahV2_$HOw5-$Wzh8IH0}p}}MKh1x z+EgkLftkikzow_Vr>8#lM8~BjtOBwg36Muu%{$CtXz%9lrVoby{a;4sA0=ZCj*SN( zS-nk^@r!NVegyVFDXtC%+FkaOwvPvg?|VTck{=L+LdS!DZoAv|gWC?En{IoeKSJE- z*E_1cdPmwBcmy)QFl%OYv=7)Ue^VpHu^h*=Z2T9m%***zPZ#6{!Va(@MmDsRHL)}} z91d!lj#Pk3k8?1Ty$6c2=3qz{oXBWu2ldzjOmYG{ID~(CP!BsTJUE2wIE-%vgU}$Y z9pyNKuWuB8=x_P;NrPb@QdR&4rBHL6h`p3bTN+g#&mS5MP$#cp34x6upnyVHTpt27 za=hhF-lvThY)+6UT!<)q2Lpm2k2#+v*Lavp)Qx4B8)RZQ)kyJ%z^TDz(2yk;qlc9J zgsV*Tgkxv|dct&1POtG|$nFN&^&{*)7Z*)@li)ryVBruzaZG}FPkPeE9+#8J z685#%x1%OO`$Q3V6Y~IirCGDo8Yvb^cD3)B>ik%>SPKK=_1InU!(B?LZ-`Pn*M382 zqke{eZwx^l{q2L%5Nf32>p9Eubl#e#>onw9B|jlF<7(fojw5K|!q2tCSL4z&-xe-j zL0ZliYXO6nn709MM$BF9&`7~{+n)N(t7-{)s%JKLtrX3l@9Q5;ECAmpmmtmGZXmvD z^QNEuG&SY>4*RLz->Jo*uPeS>)9+69Y4(vbqIgQHePg_!hT5z6=LoIp`|SpqeUR1x zTlzwG?ZXbXIqjLZg#N?4Oqa=~0d^a%j5Gh25Ul|y7K|rIEvJQv2Sq6i%w8hWa81>u z-7%$?POSkqf9YagE=pJ^w3Va(5Z8rE)GK?zSQXO=EHH{fT@9@^3Qc7yo{T1J3R9!| z*L9R$zN?NL%Z>!A908Gv@_N$XFfuT{Xsd1|l4}%TM<$$(D3K~tbiz5bSD^3W*#&C6CM z{Y%c~Q+ek%8smvLO#UryY(>>u<0YG(FM*HntN_^O3Mpv7lirkR|597wk$wwpcL)Ag zVET(zE3Dp6D-nj_c40HgJuAwX74?(aW7TVOO0UW5vMjI+j?&}u1JCmm zwurx6@afAkxomz2`S5WwD4EJ~MX!(|B*8{a8&DqsRkQD`9@-(eSH{$W_5m59@!>0vk zARxULqJDrLIkuo2z4&uZP$2$;Bc;(g+>jtN+0KUUV@E=tWJe`%GmI>rL z1c9jHuwhJf%V$qt>sQNpp`U*ip)^EgsN%pCWE6uV(589aEI*%?bAGyjm4MCD=bWLH zOMe}ZV7GVD6A{y?BaRI55~NmMYcCsOSfQM&6|8~X+YVRQR+F%vZ!>G`+h)p{ZFvkPGkF??ZV=c`lEga@7Niju1I)wk(sxxiZ4gf|PP)?e^*w2*#zDkPlcllkMs z$?tII~k0C7#36a6e;y zG%Y6#to==c7Hx8Ar=>}lMu@_#BBZ5%bW z=pS%@L_hq)(=NIns0$t#a*6p{C(y5A-rI)Zv3Tk!-9~jS>bjjtVqB268 z)(#jWW;oSys&gua0F7=)s)mGapa&pCBP%tkgiqN#FDrp!U(u_+-iS0p7k_=AM+!Tf^@S#)aY`A9 zlD}$1qi8b(JAv)3v7F)b0s~$79p3p7Wdpq|^{86Rz~{L6>d?)gJ<+kD9Lw^^CXo>3 zlw*2@&<-8SJ^eHjA7PRK1b4I^3eq7k)K6@IF$z_)7NjBvIneNat-o__NR3*& zf|3Z0&YWM(bAJFh?M{g5lp_pL$tKSlY*%-tc_CL<Q4X5>9EVuM2Q3v4$=zCi`Pa9PWWDrF?*O5Wv zCpNu=k;3ldY`UDpe14$8tI8*$cFT!^F*FEu%?H|MI03Dn9SE2whCMV0Jw^sPiyvyt zw%z6x*jrC{#$dgM2h6nI#KOpB>;OxSt<+3B+l~S! zN^M!=`hF~_EVzF;wv)uytS7~X*pF87O?;_`pqJ>AgF2i;(acEGKow<22Yo3Yvb^&kzEvu%s>4rW_Cx>K!ky5;o(=_r#Qk4+YV%w+ur`nt}C- z=H#{Jw~>5*I3&LQ1q>Sy28t;fD{UlL{7D<*PT1@%4XP23>yGRFinP=d5}@u9*fH(G>`Mhyo$ewUt<~RM|QzW$*i$ z3^5$PmAd=*7&cQBr0bWV-$^o@%uoD)hi1yTYkK%s97K`HT`=&%h})?b?jRXzW8M^v zyMnc}794EL{i6@^6Mt+NwH2O|N)PGHT()%C| zHGtg7Zm&H?qKA}rf%`S`rT-9J4iEn{l&2m~;y80n$7dEs1T8bh`b)mWQx3*=7+dxZ zD1Rjrak@xvqgbWu+y}|3&%MyBI{k@=_L9hh&2DD89E(Gxp=-uG9m7w~;SVQ*<#Pu_ zpQ3InlkQFiU6(B%MT-#DaDUq+b!&qJDI_9~@cBm8mBx^O$(4EwusE$HT}CgfwW)Z7Zd?>ol-cV(N7ERE8{2lZqJBrtwxj>pU~ zadL@$e&YsbE6XMbR(dJfCXvCm)w z7X>VHLuRE`vIEIp^2HN)OJm!p=7bMgT01z6_8uvp8V3UaHW&_mp2E|?&=~xHJ2L#^ z6&Q2U>cXGjET`0SaM(7JTG~*2?~m7X_e0;)`MjKWNysTwRKNO<9Q1w3pHdASpB77=On8>g;8ZQ_OtB~jw1}%+8RVNxfTNZ`5o3F%ZOI4q9z_{15eDQo4 z4`o11C$dif+L{lj40sI2P>KS~r=mc(I7UGc8aADl1OPY67^;-fT|Fvwnh4;PMwWjP z(LF>{>(W_!WIUsUh0?$r5Mu&HTpg?We|efx43HZaq{$jbtT3|xUo6U*N=Cq|ABIL! z>S1gXm!FI&de7m5NZ>k<^_cpVGDwYMnc>0f!oXq|b?`|v8{jRPBrpT{ zD$uVGr459t2BB(DF&(rVkBq0E;7i@9cNq)R7)GCCO#7H};aR)jn$Rk1q9|F4e{t;x zEeX%3S-FEq){1z`K*6s{@>k-TTj$`sUYGbH4`he{t_p4;-II$F!|IX)S0g_|DQ>O6 zl1Tp$FDRqosSH((v;`V)06%JV!CNg}ZQ$P>Kua!KhO zI3@vu&1Rg<>Bf<&Z1MbS%8>YHf8%D>f`ObJ&0u-M0vf!_1R|w^s9eo>l4sZQ9+d*` zWmVKi&@*&};ZLLj4l~OOpf}(`I`H`->9S6>Oh6ZHQ0SXVFWocF zR43oADZ13$?raJ3SDmcAIdJu-Ca`^BXq(VzrsUKcVX_Qvn_O|DHrcnEe;2@eN&LMcmMkgO>Sof=s`g9zZ{*vQb}Qdd#n6;b&;RyBIiX~jq>s+X6ZRUGF2NB)i)k_ zAQVbhD;6=oQ7t56tgj#L@4yTDqJ&%mqHR}zuP)rbi+$Y6g%rR2_M2pW(crdzyk8k; z?8QG@3~E!ex5isHuwQ$6e}BKYy6f4TjbS&O+F53LNt~E0$^zIh*qp~>#|_52Y>9sq z``%%T$lcSGB3lU4PQ+3!g4d;VxC)`#ajUoe$*ao`1${~Pc+PPP1Mfnj(LASpx7;8i z=G3Fd&9IwVVhN_+WDaTL1b@B(K2chuQQ}m;q!%|b?juz^7zIU+f3?7DK<+IqT-!(c z>aFw-%S9_A3$eVi@k6ch1`i)6@?gNf(f+STtmfB<#d%r$t}6nSL88Y$iR8m|>x8@M zvmk6O8Edgnz6!;Y3j2vz=nN+jzc>IBT@Sf?cddIeUW5|`%;b{jBd zv_WT-Dy_D{on+0`fBvVE+r0g<7cxR#EzvW^v}&n|a6Zq|wr-f0S1(bn;FnJao>y7M zTfbOrtS`D?$>lv+x0bqfmTn^pX(QM*{ag7Yn*p?Jmm7_comK_t*|pLOq~>elM!krIMt z@S+aNA2dh2$@=2Kdd?@8gc+pjxOx{=7g z`@w|mHh~>NSKCq=q(_F2@I;?D$=Irn+o&|Qa%W7>iB{Y+9?Nr17cvgmh>)f8a%Q4y zh|bJ{{w3{8XUbXuG*JvsoSR(zDwxD{S$dYse^^lC2<>Vx?i@G|1bEcpqs@__oqYS- zkZMm5RegZH0c@Pz-y2MEvYr&tT}}!WE$bWu+|BuiOK&pM1e+mONrmTO2JjgCg(vzTLAfzBg)=*`ss91JP31gXV@g7W(nD*HDj2t)=G-?UZmAp2RMy3 zYvHKOmodTt6n~@ojrXb26s=;AL1eLUlyTEf?9}vJ+cjg)bIgQWeiVe(*t4=8w(CEl z+rx6-Z@8=PQS-XkJ6UPLE8JFJt5hJ^9)ozx+A2I1rWV>uXup$zC&3$fA4*Y@V`E3o z+vXC$C;PabwnZQ(^0P4X9n%dxtV0INa_o$4Gx3vn9Dk4TN+IuV0_CEj=;eo^TFyW6 z>poKbJTH2P^o^{nV*G!5SGU?W42ACpdk5p|Zdo$M7`TR(FbW%^gR-mk!b|Kn%yvv{ z?+13Vci0>5Np^lDS+XVnv}rd=LNDUfvX87I={v{L_q~OndR$ADEOsL~S;VeGI9D)Ok!Tp2tT3{-0?6yl6CkbP6+vxKGn+|4`eCdCn)h`>ECx|9^jU+CJ?LCClDf+sCSrAg?}M+oxma z1Z|&A*$HEfEOn3CKIcM*rZI7fw9jo7NZcwmU;A9EZy=rEp)C(`jkkV*1YjiuAWO4= zbsW;s(OH$Hcw$h5K?xIVejU;iPdxANcOLB^TfE)(n+CQVgCPZ}LP&n}4j5Bxa3AEWCwQ$xstTY?>$)L#47=+bnWc z=Y$YH^0`M!H>u=J6Y9a7qz%RtW2&IN)Z$xW#jH1JMV5#u5zhO}nsUlVhjbboHJ zh64i54icqj*BY|*r@N~dmsI^_jawYLmzSM_dJUV~Hx=~_IqnHX8qq#+#C$Tk=!%EA zV3R@5+^vqs=rQ!k&b)`9t(C|zkXGGhr7@!YIPWn1OaY{;R+Obir9ho z0N@@0w5J1X1NzwkbuW-M$~%Db5PuLJ0@Qa0$cB|`EpqLcDwoUP?M^-{TZYI5_WlTA zwc!A63goowvyKF1bFrsPwB90ru|=lQ0000000031AOHXWXP3jq0VD=c#sL5T0D1IhqW}N^ delta 9035 zcmV-RBedM=jR)fz}ZtChiEUu5)2UhMtIs;w>N1VPf=D&ejKXB;70dM%a`Nr$RX#G&d9BWa8Sy zbeN(`tjv8S`CFOIz}e)^xbcn^%XlXJyqFXYElKq3A@)tMf2909d_jj&qZ*O3NXgN; znHg8!{aW9}ZZR82OPTsP@&Ed({545IIh*_D>)o*)>%+sJjK|Z%LwKrCI0TDRwBQZ+ zIl|N^WtLLUV1iR)5u|orD8(my?~E$goKqNE7;E_F&%fb$@MPy2E}vt`orSrpUTtq_ z>wW{hMXarSe^D`WqsPzA;lc_+gPx5l&Vg~9rTw)c7jqr6|^s0U~fV{+564ITn;4(z;_He5MZuCC!52SxsOek)-anc*RipwNw zJiwWB!e^J~D6EEzvqnrz;dijx!eOX|H5mKw2W)d`(%{{X8ziSD=|_WB6>`O-U4~i( ziY{wFKDA~c)3N|wwke=pUVo;{5JAe5rk;-)f5~mB`yLAQNIR}dZnPv9IzkG%QC>?Q z2`cISd7DYOs}D8fb$4r^(Qb2^>Jr;cHlCloYD{Tss#|NbFuIM%@?TX^^mI1s+g_-){ zeQWaj)H^%WN=#5O`EE4iicaQ6rRDhcBE$y->=C_zf|Mkt+}oGjEEUJyXw`y5e+v=r z10mr&w{-8eVj2<$)0aX~$U^`#k@reK_R93=9dr}mpdT-od;k?)AMV_3MuDC;=fu%g zcNF>l0P3@y`0EovPkPJ(9~xO5_9_$|yd9T5A4jL-=wJX$7G4eDU>ps`QP5=f?acwP zzS_VkV_RBGw`)Y(W9yRCCaQpTe^plxn&$HN7LT2!ybGl5Ys#MUilQ4X8t*AoGOeq4 zbT16^)Gq@X_VkU2n!NA6yKi*6D0i%%D3RiY^uYmpG$fpHliX^no84o}4MUHw{Z?Ds zn}!!e{XKP@>#ZjyFPrmL$6|IYqt2`Kj8@M4u5nY3MkE@9!=$=017EjwYI!`#8KC@oA%dk8-2gy zNuO;meqzT589Of8kY7)No2&y}VP(|XvuW(3b*RyfN8T_WHmlCa7c{?0p@yV3kFrAw zr5%Q8W|RF*_uwPkd3<|Mf4<=T#OSRDjYH1rC5M-u-J90d<9+$ZKfAoYrT@-645S|p ziSXtXnp3Hb)K+a4XTti={GLfj06^}|~8VTO; zh6(RWsU>!_Gv-7nlKE!x@XyWW(Z<15`|F1x;^Y$|;t|h`>;p3Uf0Kv)*|i=Qj!fkxd@6aWAK2mmKwCs%#B8iTyP0RY&8eh0UH z2La=ve+UqAv=y)I*sj=l$#E)WyOaSikZ=MC8Xzs}wEFMY-SfbMAVty4W4AVyNF(*Nk3G?GsVS>~tVaUm(N*&fa~RsY^4;vg@W21d==`H(?7^||03@roi86k% z&D)Q_9w^1t!9csqe$w{w;P8Dfh*7vqf6#4r+kSA{0d&)CPxMEK8~u7mwO8** zI|GkE1{h||td8~pn`duoq&Sx2n3j$I;+1(Bzv}6N+(6g?HpIw=ma-<628Y8zP1BJI zQ0Z|FhO+lSQPvy`>4Fm(P3@o_TYyPUU#0r-cWHa2<#7tzZxuB(_f^5z@QXrjuWw$QfW)0>f`xCqXFvVH7p^p5d;)a2#f1OfJTP5{K@;Y z@q*1M5`_y9h3{ZM5acoAv-lbhQ;E8<40D4_45u0i-Viu5*c=+N_+s>svY&93sh)5Q zO+ZhW?#byjUMxBKKEm+g+xMaw>?3FJf3qm>Xe&wmVu~qGYSKOJr1YHFBX?vyG#1$+ z=NfA?9n8^M&GUMwv$%euOIJU_?sIX`#5W1ET@NG+#@i3fQh49s34(r``Hq}?&0mrbn! zH-FipEEWYU6xzzse~9bCCF+&EV62Mi6c!jop{|Bj8-=Da6;DP}HiN0r{p&hPFW*&1 zj%9~}RgQp2d2u~$a2OdFU$j-X63I0Rup<*rN0dmFDLUaC+N;n54XNjy;)|-yMEK7( zc7Ka&Xj8PwO7EGH)`6>&qQ1LIhX$aGj(-Y$_{lcg4%l-{fOI`g_2y+Oll~=VKzNriJqt2@V4982B3 z@!4YCa{AUS4FRT=u^i7>JQ2iru*NH)Q{xj!LzhU-e+yzAo1ryW>d` zm?;~FrpIBCm{@6Qril}HJeVX_AeYUq0V#h{cQ&rLAU|-+NY%&4uW?@p{4pCWjF{>G zLGMfi?Xn81GG`!7?{vU0tDfaW#Pa${?Xl{$Ii=U+by4J421n^}`GMzI0$apiF8J(a z5nnbxgnan88I(+9xuRD{k%{kF_>U-btZqe*d^;GAExgCkGd-USt9aF=zy}c}JQi`$5|&pwDRi)4(XmMU9Ae5Wj$8lc3fOUS4Ijzk zp)qCUWl~(JHiyPrku!`^@by5gNF}=(39_QVOP;3n=texgJpziJY524N4Fsh3Levk? zBgYn$gFId4i;TQi@Z<1Kg3wf@ui1YZ)-hY{ey;1j6t%UHty&w>x2SUH+%VwW8k?aT zyQb$vSVP*kK&qnHkNhaMgUJp=6JEJ>#Ja&LD}e9t5&TCL1W)D#sAU5A4nZKQIBXab z-SXMf*ZS46%=PonB9w-x3{@Psf{bEt1llyKn`P&-qU5IwSP58}Jm(CpT`GV02RcSdtyp)ocJEz&Ko8%R%8M00qs696UPetAa&Bv z?<+0;n)Q~Y-4ssxh3Byj7qy~Dtv8)OQj^oilQ4jlKQX;1^s!j3ZL;wsHhJVa>6m+N z?AiMnt12JYGuZa44WqR}*PSHk*t9}Bf>ko{%rNEL^xeo03$agoUx^@FdvJm>qidi;l^7dAQ92x((mX#I~@nx<*JQShP%UN-i z^W>asCkaBXT`(i#tD{b(gnr)&me%};C{jk6KnugGNkt1NvX`YjIbr zEaYoyDL*#ii=wCile4-iC!nfYER*YzYOVI<&DLs1g{_q@PItfs#z0Xz7Uenc3aX@1 zB0?JjaZ!J$pcM*(Wb{PW>5%X>%ty28io<{tj`e-_3F!KDyD7&#a0%&58U zEk*WNU*^gpRbslHwCb7nxCz0LFA>2kp@aDHMD!KC>g$b2BXob!2YRHi!&zTwA{wWZktq4AMl^~x zL$FiW-Wtm}PR}>cmEYl=A5k{Y%TkZ3#SFZ}%~ywR2JMNC4dqytM>dIsD5o6LD};9F zQ10ocx%dc^3?R6p^-z!wfuVk43ye{ynzbMm8OVW#_iO!)V_9On0zqoj;uVxcXmsZM zs?2`?;H*0#s#A_IL?xRnZLnS4ndXIDT?t8u7g#1{RxDZs>QB!a_n*1!UJbo*slwPz znip5iuh}DD6QrEDuNRRd%ls-V;eF4&dZ8ofZVjoe5hMv@GY^zgm%gN0V=VSsPQ}%s z4IGV(7bzkMRdEXV1M}ZVikRvH3-*z{$(et?1eVWrSMka5$asaRI0cCo16aUs^;FM7(&^{>Tsc60|z`8)%7s3|Ix-(fGvG)zxTTx1w*v)T$D2=`QJOGnaoB zgL(NOH-!TF;3p#_gGVwF14nbcw|=4H0#Wkz{%-unW_5aU9Dx<+TU&vUTqy9z6mE(+6~#17w$MG_8*C?8&rf1L;panrC2{7<3TZ z@W3EZ*)sQ-wSHjgY)P7Q#L-YRnc08S06y`*%mh|6af#2tL^sJ4GGPo75sv4(wzY%8 zaCge3RXd0+bF#Gur=1*LKdm*^e#1mIOME-91Jg>9!1P=zGFj+N%$TQ6;`;U^aCh-) zH&f*6IFZzL&6jdgxVPCZic@<^!IVQQ8dNY=uaF^%gBw)f$AsD2LqYC;8qJ ztczPfNBy2-dyL9Q?EGvw!!(@Md$HWor$ilu8=&uP?L2K%Es#MJ^;|~=ji1=;5=IKU zkF(iw8u9W#gIASLMD3On1!HIs>Y5L<&2R!*KRpmIPYio#5PFOhbQV9^n6ZVC%g6zioLGq&d$t|=PMFxT#`XPJ zQdw~Sa%?AwuUSuu53wJunw{^% z^WrCl4;Aw_3en&f4u^FUB@Rf_#^Zk*p=e4$wu2=*#^!${!OLr%*s`3& znM@LY2PtU!RX;-ru)>nISetS{OsIFfyo%YJBi|EK9zGOA!`?CsC20oME1Hwnn%_q9 z{o#=K`WG;4Ko}^dXsoo6VDTqyj5}eow=}3mJgz&g_bbv;Pe_2eOJws^0Re*yCWrnJ z-#deCcaiWj&D-$uOdEgaI|+`K7XUSEOGZ~9@F5C>MAueg!4hTbsFc0$=Q6}_{8sAj z<73!NQIM`*hJGi>aME!+_IY3?oV%une?@*6n%o5gF9^Avc)<>mp*H4C(YPyEOKZWw zw%kAZAV2ZPhEZGLsfY(Wam_L37zOk(^biFmvtlQ2hJB5F`X-|3|#GwX|JK62E z$4K;$(k^hnM!xhPqRZjopN8_p<8c(FuIY@Kg%Lr^jIjRF*y0HX<2#5fdk2)il8HE7 zq_Lyp_0HgBc4p)C+F~o6TpA`-7 zE3x7oNcNI1p1@lg+eS4fe9+R`!D+PjNZHId7yz)raPadCo(_h_;0N51;UBNSn3Gl) z{`_V+qn?Aqwwct@hT?mFyr#P!`kt0$QFcklDO6Oy`i~s+g6@$6$?G9cVmIcI$z0%Y z&xsOq5_1vT&G&pBY+>shvVzKn)4Af^-9 zrvPou2UG?;24g5i0p?RtAY2@ypa>0{%?bj58)Xbt%IK~hl{!rX@CqZ%K8ffaqN#Q1 ztUWTGQNluDU=D~e1tYGGRsDZFODG1&jSJFbjU!f=S%5DV#atyL;MEU9BhItQ#tgmZ@IfSS9msl2{R$bR#<9%t;B{_bv5PwRB$^HI7EKbEfqdobSBTOE zLREu6HK>>lT24mB(@*fF?$o=C1!@eV&k?45%((EZU2sikl{JwUEWv-c_Jfv$XS1}} zK_qKMyk(%^S0(u?am}rBa9*!Ve31t-L;zO>w~+4fMS)>;$$_hppP>}DR$xh_e~1^9 z(ePA;sz&nb@VP3RW|(;izfOOAiE>+AgFXF;y5_}s7Ka~@~uwY*0q$9q{7^$|Il zyh^2c6Dzz0unY7IU19hWser>wvmEFRxR4HfzKFZ5Q!QiAMH>|QrqWCIj5F2Aw`+Zf(IEq+u&W}vh#zggvM;-`;($$JZ z%x_c+$r$VFhmUvQg?&*%E&<`TE5KJ5?%%~eZskIX-+uc|GQVhWTR+~f3^exQpDhNp zso7iOtsB^{J-vUwUtHbwY|bXI8&2#rHN7~BO%|p;Y#40Lqlx4ClU=sNKZk+H+8nIXw`R}?SP#Gk8{F6vNT(?fRn?4J|){?Qd zOR38abY>stSAfQ)Z^(k?A&S19zQ$`zfPN~vr zE8I!eTdVq<;L z1&c55$-1@Ft+R9+Sx6hfuIb;(C)o_3Wg9)l6$Ow$pmK8YItN1~n!)w(x{0_i*>?mW9-)ddRF;`rdp!$Wi~D?f81aj8zp zSep|inpJd)0@FLF?(T^(WtaSnZb6f|PJKXe3@XB3? zkw<@N4*1)~i429W!&#YBd*ZT3Yfy9#R$nvc5WRYOtbG$vBf%g|V^Sw|uWrWH%FMRZ zb*=0IsrZ`s5xMSo<)gQbN!iUeq!9 zn@+CxcH8UZwYqfE_Ie9d+zq|1 z-=eowai1pMDYdM~b;=C7#}R$1Q*ywoTdieKM5W>-BjbmhV?lq| zDVr^+R1mz$67ziohaQ%sLIuk@rvP{J{o&GEJ%(WxGw7)DWQm~fREDfhDxgGJJzGU} zm6w?W+!;Hu=`fB*9{AV{`NT3EOb>JdkA=xDM;;nQq<@iYip8bHQYdEb44Z$}Z>i@% zQl<~SU@%LbFsLn#mYG3;cYNROS=ZhhHLC21 zH9~f)ztboIqPR}K>#661((nyV9>q$Gf7vV}qCP^ez}kJSY}yxnXZooWfiW%cV7L0h zqL^oKb=<+twl}dUX>W0OtmNuNaw=!oB%)>s*`_sPn6TDLiuGP3)mnczjW%oHsKl5J z!>OCBhk_Dc_rGdlUM~0RUaOP(jrWPt6s=m2erT~tm~wL*+llG9wrfV7=a@0K#-Sfr z6VFO}*slMCZV$_Szu~IBN6p(}?_{L~uW(y^tuldNdko?&ORMlim|AErq5VzFcpDY7g+{_GZ$_ivH%DFox+QU(&1AUUQm$z1^)TKSAp{ zUHUvd+Sj8hPv>(~<++6_&*DB+c}%+bo;Xieis#|+fBz?vKhIjpADzL>q3zSQ+CP-` zv9sF;lT<>S*EoNmw2$*1JfzusO>mUstmiDnq zB*?2zm-aF2oFMIEl$|iv$Wr$x?QR_KaFN!9<47fp$fD~LwiOlbaTiEwzQQhd&fL%7?9tjd4-&WzkmJ;>d%O*;5vKU z_ERG(zg&N5mcdU6ZD`IJ<+0-88{V0r(npHGljBXE$Y_sMmZdE5h=sS%Dg{cSh&>av zBB)e0YkNh`_a!03_k8Y&l1-|4&xCp~XL*Y;#h5BsFSYoVNHO=Dydg`(lnCd2Vs2II z^-bX#oU-DKKEvbOfpv(?kl+sMoN$LsQYvkmH_Eq!IlS zJ?0bdqAMQeqD=ukbGJJ6kz*KAop}pETRk(SRIkFXnD>C|zkE@BgS*foYIPWUf&e$f za0Pz~14Zn>djxQM0PX1jy952~fO-%}cgj0}^B52w1Jrj1$Q>)!TI6b&DwoUP?atmU zdxpsM^`VEZ+IRpr1#;TuSv^77yxZpZ8P7Z&)_#W)oS*#*i~ahcE0oDLFgsr`8d|ax zASb)#^C!={*h&G+e$!gL{-a)0B>rsPwBAZ0eX&J`FI1oeXV=R;=FR~!bSkOWN`7st zcc_HixQZj)oNFAy3{>qK)*O8N2>$*6P)h*<6aW+e000O8OI{~e1|\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KQL Training/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe KQL Training solution for Microsoft Sentinel contains resources that can help up – skill on understanding the fundamentals and using KQL in advanced scenarios like authoring effective and optimized queries used in Sentinel Analytics, Hunting Queries, Workbooks, etc. \n\nAll content packaged in this solution is built and supported by the Microsoft Sentinel community. For any support, please create an [issue](https://github.com/Azure/Azure-Sentinel/issues) on the Microsoft Sentinel GitHub repository.\n\n**Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KQL Training/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\nThe KQL Training solution for Microsoft Sentinel contains resources that can help up – skill on understanding the fundamentals and using KQL in advanced scenarios like authoring effective and optimized queries used in Microsoft Sentinel Analytics, Hunting Queries, Workbooks, etc. \n\nAll content packaged in this solution is built and supported by the Microsoft Sentinel community. For any support, please create an [issue](https://github.com/Azure/Azure-Sentinel/issues) on the Microsoft Sentinel GitHub repository.\n\n**Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/KQL Training/Package/mainTemplate.json b/Solutions/KQL Training/Package/mainTemplate.json index 6c8ad20b018..e14c691f651 100644 --- a/Solutions/KQL Training/Package/mainTemplate.json +++ b/Solutions/KQL Training/Package/mainTemplate.json @@ -166,7 +166,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"345358d7-fa59-4e01-80ff-fd274e78d073\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"github\",\"label\":\"Github Repository\",\"type\":1,\"description\":\"This is the github repository we will use. Generally you won't change this\",\"isRequired\":true,\"isGlobal\":true,\"value\":\"Azure/Azure-Sentinel/master/Tools/IntrotoKQL\",\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"1b617550-b934-46a2-9a71-e48ef40aab00\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AllExercises\",\"type\":1,\"query\":\"externaldata (tab:string, section:string, exercises:dynamic, markdown:string) [\\r\\n @'https://raw.githubusercontent.com/{github}/all_exercises.json'\\r\\n] with (format=\\\"multijson\\\")\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e397ee05-93c3-42be-9560-80bc6b6bc178\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"json\",\"type\":1,\"query\":\"{\\\"version\\\":\\\"CustomEndpoint/1.0\\\",\\\"method\\\":\\\"GET\\\",\\\"url\\\":\\\"https://raw.githubusercontent.com/{github}/all_exercises.json\\\",\\\"contentType\\\":\\\"text/plain\\\",\\\"ignoreStandardHeaders\\\":true}\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"multiLineText\":true,\"editorLanguage\":\"json\"},\"queryType\":10},{\"id\":\"451a0851-dea1-4c88-886a-ed9736612ccb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AllDatasets\",\"type\":1,\"isGlobal\":true,\"query\":\"externaldata (tables:string) [\\r\\n@\\\"https://raw.githubusercontent.com/{github}/Datasets/all_datasets.json\\\"\\r\\n]\\r\\nwith (format=\\\"multijson\\\")\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":10},\"name\":\"parameters - 16\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ccd64330-9dc6-4388-b618-d20767f2f962\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Welcome\",\"subTarget\":\"Welcome\",\"style\":\"link\"},{\"id\":\"589778dd-4b96-4c61-a58c-eb32f5e43c41\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"09338df5-091b-46d4-9fee-63b69cb4ee76\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Scalar Operators\",\"subTarget\":\"Scalar\",\"style\":\"link\"},{\"id\":\"e536ef91-d9ea-413f-96dd-357b47ac21fb\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Advanced Aggregations\",\"subTarget\":\"Advanced\",\"style\":\"link\"},{\"id\":\"f7f6fefd-09cc-4c02-8b94-071d85ee892a\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Dataset Operators\",\"subTarget\":\"Dataset\",\"style\":\"link\"},{\"id\":\"14e62080-54b6-4194-b7e5-d5bcb22d4621\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"External Data\",\"subTarget\":\"External\",\"style\":\"link\"},{\"id\":\"7cdfef8c-7c30-4c46-9d6e-0c6f91d0886e\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"String Operators\",\"subTarget\":\"String\",\"style\":\"link\"},{\"id\":\"2e2c5a51-b3cc-4812-9235-bf1da9c42ed7\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Anomaly Operators\",\"subTarget\":\"Anomalies\",\"style\":\"link\"},{\"id\":\"084b5b60-1666-4d85-a580-cc37bcd17027\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Misc. Operators\",\"subTarget\":\"Misc\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Welcome!\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"### Summary\\r\\nWelcome to the Intro to KQL workbook. This workbook has been developed to assist new and existing users learn and grow in the Kusto Query Language (KQL). The goal of this workbook is to introduce the most commonly used KQL operators that are relevant to Microsoft Sentinel. By the end of the workbook, your knowledge will be at a 200 level.
\\r\\n\\r\\nThis workbook will be a living resource in that it will continue to be improved over time based on feedback, requests, and newly introduced scenarios. The version of this workbook is currently V1.1.\\r\\n

\\r\\n\\r\\n### Structure\\r\\nThis workbook is comprised of multiple tabs. Each tab contains several key items:\\r\\n- Operator: choose an operator to study.\\r\\n- Exercise: choose an exercise to practice.\\r\\n- Data type: corresponds to the data table that is being used in the exercise.\\r\\n- Answer: decide if you would like to to see the answer.\\r\\n- Summary: details about the operator that has been selected.\\r\\n- Example: samples of how a real query would look like with the selected operator.\\r\\n- When to use: advice around when the selected operator is used with Microsoft Sentinel.\\r\\n\\r\\n#### Exercise Space\\r\\nThe exercise area is made up of 6 main items:\\r\\n- Question: selected exercise to perform.\\r\\n- Answer space: location where you will enter your answer.\\r\\n- Expected answer: the expected answer that you are attempting to achieve.\\r\\n- Your answer: the results from the query you have written.\\r\\n- Answer Checker: lists if the answer you have entered is correct or not.\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"### Workflow\\r\\n\\r\\n1. Select a tab to navigate.\\r\\n2. Choose an operator to practice.\\r\\n3. Select an exercise to attempt.\\r\\n4. Enter your answer and confirm if it is correct. If not, reference documentation and content until correct.\\r\\n5. Move on to another operator or attempt other exercises for that operator.\\r\\n\\r\\n### Helpful Links\\r\\n\\r\\n**KQL Public Documentation:** https://docs.microsoft.com/azure/data-explorer/kusto/query/\\r\\n\\r\\n**Pluralsight KQL Course:** https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch\\r\\n\\r\\n**KQL CheatSheet:** https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/azure-data-explorer-kql-cheat-sheets/ba-p/1057404\\r\\n\\r\\n**Log Analytics Demo Environment:** https://aka.ms/lademo\\r\\n\\r\\n**Microsoft Sentinel Compiled Level 400 Training:** https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Welcome\"},\"name\":\"Welcome\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1ad61717-0dd7-430b-a948-cef2d3618738\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Section\",\"label\":\"Select Section\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where tab == \\\"{Tab}\\\"\\r\\n| distinct section\\r\\n| serialize Rank = row_number()\\r\\n| project value = section, label = section, selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"\"},{\"id\":\"0c106e37-c059-4b2b-a80d-c4119629d1a9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Exercise\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where section == \\\"{Section}\\\" and tab == \\\"{Tab}\\\"\\r\\n| mvexpand exercises=(exercises.value)\\r\\n| evaluate bag_unpack(exercises)\\r\\n| extend packed = pack_all()\\r\\n| serialize Rank = row_number()\\r\\n| project\\r\\n value = tostring(packed),\\r\\n label = name,\\r\\n selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b2ae8bac-db12-4c75-8d3e-42c002d288d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Dataset\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"let exercise = todynamic(\\\"{Exercise:escapejson}\\\");\\r\\nlet dataset = iff( isempty(exercise.dataset), \\\"Weather\\\", exercise.dataset);\\r\\ndatatable(tables:string)[\\\"{AllDatasets:escapejson}\\\"]\\r\\n| mvexpand todynamic(tables)\\r\\n| evaluate bag_unpack(tables)\\r\\n| extend kql = base64_decode_tostring(kql_reference)\\r\\n| serialize Rank = row_number()\\r\\n| project value = kql, label = name, selected = iff(name == dataset, true, false)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"2f5c56e7-dee3-46e7-b699-e331079e1d47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Question\",\"type\":1,\"isGlobal\":true,\"query\":\"print(todynamic(\\\"{Exercise:escapejson}\\\").question)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e5be7ed3-5eed-4b66-9db7-a0c2c132783b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Answer\",\"type\":1,\"isGlobal\":true,\"query\":\"let answer = todynamic(\\\"{Exercise:escapejson}\\\").answer;\\r\\nprint(base64_decode_tostring(tostring(answer)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"d4ecbbf3-25a0-4130-bc7d-50edead67b01\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Markdown\",\"type\":1,\"query\":\"let markdown = todynamic(\\\"{Exercise:escapejson}\\\").markdown;\\r\\nprint(base64_decode_tostring(tostring(markdown)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4c94574f-3e3d-4d73-bed8-3eeebed298d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowDoc\",\"label\":\"Show Documentation\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : true},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": false}\\r\\n]\",\"value\":\"No\"},{\"id\":\"ad9dc5ed-16a0-4157-88a2-bfe937e34e3a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowAnswer\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"label\":\"Show Answer\"},{\"id\":\"4f9a31b5-1f75-42af-85a7-c96af37a0d0c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LetDetected\",\"type\":1,\"query\":\"let result = iff(\\\"{Section}\\\" in ('Let','Union', 'Parse', 'Materialize', 'Function'), true, false);\\r\\nprint(result)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Error\",\"label\":\"Seeing Error\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"id\":\"9edc3ceb-a3a7-42bd-8ce1-e7ad666934e4\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"100\",\"name\":\"parameters - 4 - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Fixing the Error\\r\\n\\r\\nThe error you are seeing is due to workbooks in Azure requiring external data sources to be marked as trusted. As this workbook pulls all of its content from GitHub, the repository must be marked as trusted. This is on a user session level and cannot be set within the workbook template. To fix the error:\\r\\n\\r\\n1. Go into edit mode.\\r\\n2. Under the hidden parameters at the top of the page, click edit.\\r\\n3. Check the box next to json.\\r\\n4. Click on the edit pencil icon.\\r\\n5. Click 'run query'.\\r\\n6. Click 'mark as trusted'.\\r\\n7. Click save.\\r\\n8. Exit edit mode.\\r\\n\\r\\nThe error should be gone and the content will be loaded.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Error\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 12\"},{\"type\":1,\"content\":{\"json\":\"The Kusto Query Language is the query language of choice within Microsoft Sentinel, Azure Log Analytics, and Azure Data Explorer. Kusto is similar to SQL in syntax and logic. The basic structure of Kusto appears as so:\\r\\n\\r\\nTable | operator clause/predicate\\r\\n\\r\\nThe table will specify which logs will be queried. The operator will dictate what type of filter, action, etc.\",\"style\":\"success\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"}],\"name\":\"Welcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## {Section} - Exercise: {Exercise:label}\\r\\n\\r\\n{Markdown}\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"NotWelcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

\\r\\n![Question](https://shields.io/badge/-Question-informational)\\r\\n
{Question}\\r\\n

\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"text - 9\"},{\"type\":1,\"content\":{\"json\":\"

Answer

\\r\\n\\r\\n```\\r\\n{Answer}\\r\\n```\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowAnswer\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown - Copy\"}]},\"customWidth\":\"50\",\"name\":\"Question\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"341ea875-d1ff-4cbc-a9f6-421eeb82368c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Query\",\"type\":1,\"description\":\"Enter KQL query here to answer\",\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"multiLineText\":true,\"editorLanguage\":\"kql\",\"multiLineHeight\":7},\"criteriaData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"resultValType\":\"static\",\"resultVal\":\"{Dataset:label} | limit 10\"}}],\"timeContext\":{\"durationMs\":86400000},\"label\":\"Put your answer here\"}],\"style\":\"formVertical\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"QueryControl\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Results\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Answer}\",\"size\":1,\"title\":\"Expected Results\",\"noDataMessage\":\"Had trouble producing the expected answer\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":500}},\"customWidth\":\"40\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HTarget\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Query}\",\"size\":1,\"title\":\"Your answer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Error\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"code\",\"formatter\":5},{\"columnMatch\":\"message\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}}],\"rowLimit\":500},\"customWidth\":\"45\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HResult\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let get_table_hash = (t:(*)) {\\r\\n t\\r\\n | project packed = pack_all()\\r\\n | summarize list = make_list(packed)\\r\\n | project hashvalue = hash(tostring(list))\\r\\n};\\r\\nlet check_tables_match = (table1:(*), table2:(*)) {\\r\\n get_table_hash(table1)\\r\\n | join get_table_hash(table2) on hashvalue\\r\\n | project match = iff(hashvalue == hashvalue1, true, false)\\r\\n};\\r\\nlet {Dataset:label} = () {{Dataset}};\\r\\nlet answer = {Query};\\r\\nlet correctAnswer = {Answer};\\r\\ncheck_tables_match(answer, correctAnswer)\",\"size\":4,\"noDataMessage\":\"Answer does not seem to be correct\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"match\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"success\",\"text\":\"Answer is Correct\"}]}}],\"rowLimit\":500},\"graphSettings\":{\"type\":0}},\"customWidth\":\"15\",\"conditionalVisibilities\":[{\"parameterName\":\"Query\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},{\"parameterName\":\"Answer\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LetDetected\",\"comparison\":\"isEqualTo\"}],\"name\":\"Result\"},{\"type\":1,\"content\":{\"json\":\"This exercise includes use of a let statement which cannot be evaluated. Please manually validate if your answer matches the expected results\",\"style\":\"warning\"},\"customWidth\":\"15\",\"conditionalVisibility\":{\"parameterName\":\"LetDetected\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"Results\"},{\"type\":1,\"content\":{\"json\":\"Set the path to the Advanced KQL workbook in your environment.
\\r\\n\\r\\nNote: If nothing is within the drop-down, you do not have the workbook deployed in your environment. You can find the workbook within the workbook gallery.\",\"style\":\"info\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"String\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Anomalies\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Misc\"}],\"customWidth\":\"50\",\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::selected\"],\"parameters\":[{\"id\":\"ed7e252c-2ae9-4be5-9e80-267b0274a9d9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AdvancedKQLWorkbookPath\",\"type\":2,\"query\":\"resources\\r\\n| where type == \\\"microsoft.insights/workbooks\\\"\\r\\n| where properties.displayName has 'advanced KQL for microsoft sentinel'\\r\\n| extend path = trim('[]', id)\\r\\n| project path\\r\\n| take 1\",\"crossComponentResources\":[\"value::selected\"],\"value\":\"\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"parameters - 10\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"173f69f1-a9c0-4ebc-a497-3e7354a32236\",\"cellValue\":\"{AdvancedKQLWorkbookPath}\",\"linkTarget\":\"Resource\",\"linkLabel\":\"Advanced KQL Framework\",\"subTarget\":\"Workbook\",\"preText\":\"If you would like to study more advanced topics:\",\"style\":\"primary\",\"linkIsContextBlade\":true,\"workbookContext\":{\"componentIdSource\":\"parameter\",\"componentId\":\"AdvancedKQLPath\",\"resourceIdsSource\":\"parameter\",\"resourceIds\":\"AdvancedKQLPath\",\"templateIdSource\":\"parameter\",\"templateId\":\"AdvancedKQLPath\",\"typeSource\":\"workbook\",\"gallerySource\":\"workbook\",\"locationSource\":\"default\"}},{\"id\":\"690a89fe-5c1d-4313-b442-ce059670840f\",\"cellValue\":\"https://aka.ms/lademo\",\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"ALA Demo\",\"preText\":\"If you would like to test any of the lessons learned, you can use the ALA Demo workspace here: \",\"style\":\"primary\",\"linkIsContextBlade\":true,\"bladeOpenContext\":{\"bladeName\":\"DemoLogsBlade\",\"extensionName\":\"Microsoft_Azure_Monitoring_Logs\"}},{\"id\":\"295f7752-374b-4680-b281-c5cb8b83d384\",\"cellValue\":\"https://aka.ms/introtokqlsurvey\",\"linkTarget\":\"Url\",\"linkLabel\":\"Feedback Form\",\"preText\":\"If you would like to submit feedback for this solution, please click on the form link here: \",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"links - 9\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"IntrotoKQL\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"345358d7-fa59-4e01-80ff-fd274e78d073\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"github\",\"label\":\"Github Repository\",\"type\":1,\"description\":\"This is the github repository we will use. Generally you won't change this\",\"isRequired\":true,\"isGlobal\":true,\"value\":\"Azure/Azure-Sentinel/master/Tools/IntrotoKQL\",\"isHiddenWhenLocked\":true,\"timeContext\":{\"durationMs\":86400000}},{\"id\":\"1b617550-b934-46a2-9a71-e48ef40aab00\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AllExercises\",\"type\":1,\"query\":\"externaldata (tab:string, section:string, exercises:dynamic, markdown:string) [\\r\\n @'https://raw.githubusercontent.com/{github}/all_exercises.json'\\r\\n] with (format=\\\"multijson\\\")\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e397ee05-93c3-42be-9560-80bc6b6bc178\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"json\",\"type\":1,\"query\":\"{\\\"version\\\":\\\"CustomEndpoint/1.0\\\",\\\"method\\\":\\\"GET\\\",\\\"url\\\":\\\"https://raw.githubusercontent.com/{github}/all_exercises.json\\\",\\\"contentType\\\":\\\"text/plain\\\",\\\"ignoreStandardHeaders\\\":true}\",\"isHiddenWhenLocked\":true,\"typeSettings\":{\"multiLineText\":true,\"editorLanguage\":\"json\"},\"queryType\":10},{\"id\":\"451a0851-dea1-4c88-886a-ed9736612ccb\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AllDatasets\",\"type\":1,\"isGlobal\":true,\"query\":\"externaldata (tables:string) [\\r\\n@\\\"https://raw.githubusercontent.com/{github}/Datasets/all_datasets.json\\\"\\r\\n]\\r\\nwith (format=\\\"multijson\\\")\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":10},\"name\":\"parameters - 16\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ccd64330-9dc6-4388-b618-d20767f2f962\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Welcome\",\"subTarget\":\"Welcome\",\"style\":\"link\"},{\"id\":\"589778dd-4b96-4c61-a58c-eb32f5e43c41\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Overview\",\"subTarget\":\"Overview\",\"style\":\"link\"},{\"id\":\"09338df5-091b-46d4-9fee-63b69cb4ee76\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Scalar Operators\",\"subTarget\":\"Scalar\",\"style\":\"link\"},{\"id\":\"e536ef91-d9ea-413f-96dd-357b47ac21fb\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Advanced Aggregations\",\"subTarget\":\"Advanced\",\"style\":\"link\"},{\"id\":\"f7f6fefd-09cc-4c02-8b94-071d85ee892a\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Dataset Operators\",\"subTarget\":\"Dataset\",\"style\":\"link\"},{\"id\":\"14e62080-54b6-4194-b7e5-d5bcb22d4621\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"External Data\",\"subTarget\":\"External\",\"style\":\"link\"},{\"id\":\"7cdfef8c-7c30-4c46-9d6e-0c6f91d0886e\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"String Operators\",\"subTarget\":\"String\",\"style\":\"link\"},{\"id\":\"2e2c5a51-b3cc-4812-9235-bf1da9c42ed7\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Anomaly Operators\",\"subTarget\":\"Anomalies\",\"style\":\"link\"},{\"id\":\"084b5b60-1666-4d85-a580-cc37bcd17027\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Misc. Operators\",\"subTarget\":\"Misc\",\"style\":\"link\"}]},\"name\":\"links - 7\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Welcome!\"},\"name\":\"text - 2\"},{\"type\":1,\"content\":{\"json\":\"### Summary\\r\\nWelcome to the Intro to KQL workbook. This workbook has been developed to assist new and existing users learn and grow in the Kusto Query Language (KQL). The goal of this workbook is to introduce the most commonly used KQL operators that are relevant to Microsoft Sentinel. By the end of the workbook, your knowledge will be at a 200 level.
\\r\\n\\r\\nThis workbook will be a living resource in that it will continue to be improved over time based on feedback, requests, and newly introduced scenarios. The version of this workbook is currently V1.1.\\r\\n

\\r\\n\\r\\n### Structure\\r\\nThis workbook is comprised of multiple tabs. Each tab contains several key items:\\r\\n- Operator: choose an operator to study.\\r\\n- Exercise: choose an exercise to practice.\\r\\n- Data type: corresponds to the data table that is being used in the exercise.\\r\\n- Answer: decide if you would like to to see the answer.\\r\\n- Summary: details about the operator that has been selected.\\r\\n- Example: samples of how a real query would look like with the selected operator.\\r\\n- When to use: advice around when the selected operator is used with Microsoft Sentinel.\\r\\n\\r\\n#### Exercise Space\\r\\nThe exercise area is made up of 6 main items:\\r\\n- Question: selected exercise to perform.\\r\\n- Answer space: location where you will enter your answer.\\r\\n- Expected answer: the expected answer that you are attempting to achieve.\\r\\n- Your answer: the results from the query you have written.\\r\\n- Answer Checker: lists if the answer you have entered is correct or not.\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"### Workflow\\r\\n\\r\\n1. Select a tab to navigate.\\r\\n2. Choose an operator to practice.\\r\\n3. Select an exercise to attempt.\\r\\n4. Enter your answer and confirm if it is correct. If not, reference documentation and content until correct.\\r\\n5. Move on to another operator or attempt other exercises for that operator.\\r\\n\\r\\n### Helpful Links\\r\\n\\r\\n**KQL Public Documentation:** https://docs.microsoft.com/azure/data-explorer/kusto/query/\\r\\n\\r\\n**Pluralsight KQL Course:** https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch\\r\\n\\r\\n**KQL CheatSheet:** https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/azure-data-explorer-kql-cheat-sheets/ba-p/1057404\\r\\n\\r\\n**Log Analytics Demo Environment:** https://aka.ms/lademo\\r\\n\\r\\n**Microsoft Sentinel Compiled Level 400 Training:** https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Welcome\"},\"name\":\"Welcome\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1ad61717-0dd7-430b-a948-cef2d3618738\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Section\",\"label\":\"Select Section\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where tab == \\\"{Tab}\\\"\\r\\n| distinct section\\r\\n| serialize Rank = row_number()\\r\\n| project value = section, label = section, selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"\"},{\"id\":\"0c106e37-c059-4b2b-a80d-c4119629d1a9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Exercise\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where section == \\\"{Section}\\\" and tab == \\\"{Tab}\\\"\\r\\n| mvexpand exercises=(exercises.value)\\r\\n| evaluate bag_unpack(exercises)\\r\\n| extend packed = pack_all()\\r\\n| serialize Rank = row_number()\\r\\n| project\\r\\n value = tostring(packed),\\r\\n label = name,\\r\\n selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b2ae8bac-db12-4c75-8d3e-42c002d288d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Dataset\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"let exercise = todynamic(\\\"{Exercise:escapejson}\\\");\\r\\nlet dataset = iff( isempty(exercise.dataset), \\\"Weather\\\", exercise.dataset);\\r\\ndatatable(tables:string)[\\\"{AllDatasets:escapejson}\\\"]\\r\\n| mvexpand todynamic(tables)\\r\\n| evaluate bag_unpack(tables)\\r\\n| extend kql = base64_decode_tostring(kql_reference)\\r\\n| serialize Rank = row_number()\\r\\n| project value = kql, label = name, selected = iff(name == dataset, true, false)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"2f5c56e7-dee3-46e7-b699-e331079e1d47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Question\",\"type\":1,\"isGlobal\":true,\"query\":\"print(todynamic(\\\"{Exercise:escapejson}\\\").question)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e5be7ed3-5eed-4b66-9db7-a0c2c132783b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Answer\",\"type\":1,\"isGlobal\":true,\"query\":\"let answer = todynamic(\\\"{Exercise:escapejson}\\\").answer;\\r\\nprint(base64_decode_tostring(tostring(answer)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"d4ecbbf3-25a0-4130-bc7d-50edead67b01\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Markdown\",\"type\":1,\"query\":\"let markdown = todynamic(\\\"{Exercise:escapejson}\\\").markdown;\\r\\nprint(base64_decode_tostring(tostring(markdown)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4c94574f-3e3d-4d73-bed8-3eeebed298d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowDoc\",\"label\":\"Show Documentation\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : true},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": false}\\r\\n]\",\"value\":\"No\"},{\"id\":\"ad9dc5ed-16a0-4157-88a2-bfe937e34e3a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowAnswer\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"label\":\"Show Answer\"},{\"id\":\"4f9a31b5-1f75-42af-85a7-c96af37a0d0c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LetDetected\",\"type\":1,\"query\":\"let result = iff(\\\"{Section}\\\" in ('Let','Union', 'Parse', 'Materialize', 'Function'), true, false);\\r\\nprint(result)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Error\",\"label\":\"Seeing Error\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"id\":\"9edc3ceb-a3a7-42bd-8ce1-e7ad666934e4\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"100\",\"name\":\"parameters - 4 - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Fixing the Error\\r\\n\\r\\nThe error you are seeing is due to workbooks in Azure requiring external data sources to be marked as trusted. As this workbook pulls all of its content from GitHub, the repository must be marked as trusted. This is on a user session level and cannot be set within the workbook template. To fix the error:\\r\\n\\r\\n1. Go into edit mode.\\r\\n2. Under the hidden parameters at the top of the page, click edit.\\r\\n3. Check the box next to json.\\r\\n4. Click on the edit pencil icon.\\r\\n5. Click 'run query'.\\r\\n6. Click 'mark as trusted'.\\r\\n7. Click save.\\r\\n8. Exit edit mode.\\r\\n\\r\\nThe error should be gone and the content will be loaded.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Error\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 12\"},{\"type\":1,\"content\":{\"json\":\"The Kusto Query Language is the query language of choice within Microsoft Sentinel, Azure Log Analytics, and Azure Data Explorer. Kusto is similar to SQL in syntax and logic. The basic structure of Kusto appears as so:\\r\\n\\r\\nTable | operator clause/predicate\\r\\n\\r\\nThe table will specify which logs will be queried. The operator will dictate what type of filter, action, etc.\",\"style\":\"success\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"}],\"name\":\"Welcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## {Section} - Exercise: {Exercise:label}\\r\\n\\r\\n{Markdown}\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"NotWelcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"

\\r\\n![Question](https://shields.io/badge/-Question-informational)\\r\\n
{Question}\\r\\n

\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"text - 9\"},{\"type\":1,\"content\":{\"json\":\"

Answer

\\r\\n\\r\\n```\\r\\n{Answer}\\r\\n```\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowAnswer\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown - Copy\"}]},\"customWidth\":\"50\",\"name\":\"Question\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"341ea875-d1ff-4cbc-a9f6-421eeb82368c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Query\",\"type\":1,\"description\":\"Enter KQL query here to answer\",\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"multiLineText\":true,\"editorLanguage\":\"kql\",\"multiLineHeight\":7},\"criteriaData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"resultValType\":\"static\",\"resultVal\":\"{Dataset:label} | limit 10\"}}],\"timeContext\":{\"durationMs\":86400000},\"label\":\"Put your answer here\"}],\"style\":\"formVertical\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"QueryControl\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Results\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Answer}\",\"size\":1,\"title\":\"Expected Results\",\"noDataMessage\":\"Had trouble producing the expected answer\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":500}},\"customWidth\":\"40\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HTarget\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Query}\",\"size\":1,\"title\":\"Your answer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Error\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"code\",\"formatter\":5},{\"columnMatch\":\"message\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}}],\"rowLimit\":500}},\"customWidth\":\"45\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HResult\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let get_table_hash = (t:(*)) {\\r\\n t\\r\\n | project packed = pack_all()\\r\\n | summarize list = make_list(packed)\\r\\n | project hashvalue = hash(tostring(list))\\r\\n};\\r\\nlet check_tables_match = (table1:(*), table2:(*)) {\\r\\n get_table_hash(table1)\\r\\n | join get_table_hash(table2) on hashvalue\\r\\n | project match = iff(hashvalue == hashvalue1, true, false)\\r\\n};\\r\\nlet {Dataset:label} = () {{Dataset}};\\r\\nlet answer = {Query};\\r\\nlet correctAnswer = {Answer};\\r\\ncheck_tables_match(answer, correctAnswer)\",\"size\":4,\"noDataMessage\":\"Answer does not seem to be correct\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"match\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"success\",\"text\":\"Answer is Correct\"}]}}],\"rowLimit\":500},\"graphSettings\":{\"type\":0}},\"customWidth\":\"15\",\"conditionalVisibilities\":[{\"parameterName\":\"Query\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},{\"parameterName\":\"Answer\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LetDetected\",\"comparison\":\"isEqualTo\"}],\"name\":\"Result\"},{\"type\":1,\"content\":{\"json\":\"This exercise includes use of a let statement which cannot be evaluated. Please manually validate if your answer matches the expected results\",\"style\":\"warning\"},\"customWidth\":\"15\",\"conditionalVisibility\":{\"parameterName\":\"LetDetected\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"Results\"},{\"type\":1,\"content\":{\"json\":\"Set the path to the Advanced KQL workbook in your environment.
\\r\\n\\r\\nNote: If nothing is within the drop-down, you do not have the workbook deployed in your environment. You can find the workbook within the workbook gallery.\",\"style\":\"info\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"String\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Anomalies\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Misc\"}],\"customWidth\":\"50\",\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::selected\"],\"parameters\":[{\"id\":\"ed7e252c-2ae9-4be5-9e80-267b0274a9d9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AdvancedKQLWorkbookPath\",\"type\":2,\"query\":\"resources\\r\\n| where type == \\\"microsoft.insights/workbooks\\\"\\r\\n| where properties.displayName has 'advanced KQL for microsoft sentinel'\\r\\n| extend path = trim('[]', id)\\r\\n| project path\\r\\n| take 1\",\"crossComponentResources\":[\"value::selected\"],\"value\":\"\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"parameters - 10\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"173f69f1-a9c0-4ebc-a497-3e7354a32236\",\"cellValue\":\"{AdvancedKQLWorkbookPath}\",\"linkTarget\":\"Resource\",\"linkLabel\":\"Advanced KQL Framework\",\"subTarget\":\"Workbook\",\"preText\":\"If you would like to study more advanced topics:\",\"style\":\"primary\",\"linkIsContextBlade\":true,\"workbookContext\":{\"componentIdSource\":\"parameter\",\"componentId\":\"AdvancedKQLPath\",\"resourceIdsSource\":\"parameter\",\"resourceIds\":\"AdvancedKQLPath\",\"templateIdSource\":\"parameter\",\"templateId\":\"AdvancedKQLPath\",\"typeSource\":\"workbook\",\"gallerySource\":\"workbook\",\"locationSource\":\"default\"}},{\"id\":\"690a89fe-5c1d-4313-b442-ce059670840f\",\"cellValue\":\"https://aka.ms/lademo\",\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"ALA Demo\",\"preText\":\"If you would like to test any of the lessons learned, you can use the ALA Demo workspace here: \",\"style\":\"primary\",\"linkIsContextBlade\":true,\"bladeOpenContext\":{\"bladeName\":\"DemoLogsBlade\",\"extensionName\":\"Microsoft_Azure_Monitoring_Logs\"}},{\"id\":\"295f7752-374b-4680-b281-c5cb8b83d384\",\"cellValue\":\"https://aka.ms/introtokqlsurvey\",\"linkTarget\":\"Url\",\"linkLabel\":\"Feedback Form\",\"preText\":\"If you would like to submit feedback for this solution, please click on the form link here: \",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"links - 9\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"IntrotoKQL\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel"