From a7ba5a094e502f1e5488654b20fc79681d60f762 Mon Sep 17 00:00:00 2001
From: v-atulyadav <104008048+v-atulyadav@users.noreply.github.com>
Date: Fri, 8 Sep 2023 09:41:57 +0530
Subject: [PATCH] updated for branding
---
Solutions/KQL Training/Package/3.0.0.zip | Bin 116461 -> 116458 bytes
.../Package/createUiDefinition.json | 2 +-
.../KQL Training/Package/mainTemplate.json | 2 +-
3 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/Solutions/KQL Training/Package/3.0.0.zip b/Solutions/KQL Training/Package/3.0.0.zip
index 7b8bb88892f64c45a2b1e818fd41394a15d1e935..a4f374787211aa29356d9a72fce5f68b553e9e65 100644
GIT binary patch
delta 9026
zcmV-IBfZ@1jR)$D2OCgJ0|XQR000O8Crv0Ao|oLOUy)c2GP>{+?`D(U`hFV{G1M@
zMl~U4k&=@OvoNl_`=!2%-D)w7)-v@=;{W+)`Ad?5ap+PSu73aV>&eGvlk;^5L#+lfV@^E#d
z&02$Wu4pSDZU~ER;wpi)!Y)vk#6!r@`chiy7wMo@CT1U!AZY8fwVQkf4H}^~3plVu
z>d4v76gELeT!n{3Xjr1kp~%UCKf&EdrGWSpIwdfAf_UxuIURoq&L6@Z&^Z*2uUHMK
zL8L386HLJ+sD+irfs!`}qVP*&nGol5OuSrScx(uinS4bLek;&Q(ueSuGN&Hx&$Un+
zPw*bW!-CHi@MHOE1TT!enHh6KAJHcZ>te}FhiQzkPv(TIR*$DCyZAnOcx`L|^%eMz!9eSe=iGLvd!(v7e
z%#D-Y*iBrfQ{w^7sZ&0?x6D%P+Z!tb!prAdf4KW;Fcnq(M_
zTJ^{kvvxshl`6Wdq50IBl}yW0c-5wWcA@=&azq3vPnv(qK4~Pkr5<`H)FbVN{2P7`^p$~DcOqXlB>v^3I~CNtHl;PWlcr4sVp~0y{Ys81Sf!_
z-jPt1>F}mfmCCwDUoAoju>*yA;g^Gs69>bXEgXN2j)&J#*VR-;o$mw5((tqpJ^1#r
zi%gn1{4z)+`2>$aJ2^>^Oh-qpY<9%!L`_x4{)Jn`yF?l~4az!UgqtbGadmiEg0uG4YK|x9qQ||I>ZkvkZ
zZnS@DL865S_l}Too}0UOdoc}(gXzygQOH98Gm#HUKn}|E7#wvI;Aj}Hn0y2k-4O16
z)eHp#Z!Uru#Lb?Xhi1Y7>7|K)bH12hDZ)zZQ?)Qr-p9{xxOKMMcpK
z7Y+IpDw)<*Jh~Ugdg_+}4F~#0L`~jz-`zL5U6ec4&y+~eZ9yw%l@`|@E-0wd3%3PKIcuv=)DJxL(c1Uhu5F}oony$q5R{YKJV}8
z-OfRk2%B#)#8&&B2YFiJW&IX-4TozfqL
zE8MQ?oJShhff}pDfT2QTwjzer|Awfb5qWu6UYNmV2t`hXgz&hgjl1DZsI=f^hVKut
z?U&|!cg&z=IWM}S+jf{8w^moW=xQ#l^Mn65!I7s1?=i)VXtJXHt$q>4uv+|jD|u(!
z3nN=?LuXuzI+oR61|5>^V9hi=(&{}S_>_LpzkdKwO9KQH0000809Q;XSG#ZAKf1mF
z0NI0o2e*F*0pp^7LCDcoytZSzV&^5tsg&(f2EahV2_$HOw5-$Wzh8IH0}p}}MKh1x
z+EgkLftkikzow_Vr>8#lM8~BjtOBwg36Muu%{$CtXz%9lrVoby{a;4sA0=ZCj*SN(
zS-nk^@r!NVegyVFDXtC%+FkaOwvPvg?|VTck{=L+LdS!DZoAv|gWC?En{IoeKSJE-
z*E_1cdPmwBcmy)QFl%OYv=7)Ue^VpHu^h*=Z2T9m%***zPZ#6{!Va(@MmDsRHL)}}
z91d!lj#Pk3k8?1Ty$6c2=3qz{oXBWu2ldzjOmYG{ID~(CP!BsTJUE2wIE-%vgU}$Y
z9pyNKuWuB8=x_P;NrPb@QdR&4rBHL6h`p3bTN+g#&mS5MP$#cp34x6upnyVHTpt27
za=hhF-lvThY)+6UT!<)q2Lpm2k2#+v*Lavp)Qx4B8)RZQ)kyJ%z^TDz(2yk;qlc9J
zgsV*Tgkxv|dct&1POtG|$nFN&^&{*)7Z*)@li)ryVBruzaZG}FPkPeE9+#8J
z685#%x1%OO`$Q3V6Y~IirCGDo8Yvb^cD3)B>ik%>SPKK=_1InU!(B?LZ-`Pn*M382
zqke{eZwx^l{q2L%5Nf32>p9Eubl#e#>onw9B|jlF<7(fojw5K|!q2tCSL4z&-xe-j
zL0ZliYXO6nn709MM$BF9&`7~{+n)N(t7-{)s%JKLtrX3l@9Q5;ECAmpmmtmGZXmvD
z^QNEuG&SY>4*RLz->Jo*uPeS>)9+69Y4(vbqIgQHePg_!hT5z6=LoIp`|SpqeUR1x
zTlzwG?ZXbXIqjLZg#N?4Oqa=~0d^a%j5Gh25Ul|y7K|rIEvJQv2Sq6i%w8hWa81>u
z-7%$?POSkqf9YagE=pJ^w3Va(5Z8rE)GK?zSQXO=EHH{fT@9@^3Qc7yo{T1J3R9!|
z*L9R$zN?NL%Z>!A908Gv@_N$XFfuT{Xsd1|l4}%TM<$$(D3K~tbiz5bSD^3W*#&C6CM
z{Y%c~Q+ek%8smvLO#UryY(>>u<0YG(FM*HntN_^O3Mpv7lirkR|597wk$wwpcL)Ag
zVET(zE3Dp6D-nj_c
\\r\\n\\r\\n### Structure\\r\\nThis workbook is comprised of multiple tabs. Each tab contains several key items:\\r\\n- Operator: choose an operator to study.\\r\\n- Exercise: choose an exercise to practice.\\r\\n- Data type: corresponds to the data table that is being used in the exercise.\\r\\n- Answer: decide if you would like to to see the answer.\\r\\n- Summary: details about the operator that has been selected.\\r\\n- Example: samples of how a real query would look like with the selected operator.\\r\\n- When to use: advice around when the selected operator is used with Microsoft Sentinel.\\r\\n\\r\\n#### Exercise Space\\r\\nThe exercise area is made up of 6 main items:\\r\\n- Question: selected exercise to perform.\\r\\n- Answer space: location where you will enter your answer.\\r\\n- Expected answer: the expected answer that you are attempting to achieve.\\r\\n- Your answer: the results from the query you have written.\\r\\n- Answer Checker: lists if the answer you have entered is correct or not.\\r\\n\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 1\"},{\"type\":1,\"content\":{\"json\":\"### Workflow\\r\\n\\r\\n1. Select a tab to navigate.\\r\\n2. Choose an operator to practice.\\r\\n3. Select an exercise to attempt.\\r\\n4. Enter your answer and confirm if it is correct. If not, reference documentation and content until correct.\\r\\n5. Move on to another operator or attempt other exercises for that operator.\\r\\n\\r\\n### Helpful Links\\r\\n\\r\\n**KQL Public Documentation:** https://docs.microsoft.com/azure/data-explorer/kusto/query/\\r\\n\\r\\n**Pluralsight KQL Course:** https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch\\r\\n\\r\\n**KQL CheatSheet:** https://techcommunity.microsoft.com/t5/azure-data-explorer-blog/azure-data-explorer-kql-cheat-sheets/ba-p/1057404\\r\\n\\r\\n**Log Analytics Demo Environment:** https://aka.ms/lademo\\r\\n\\r\\n**Microsoft Sentinel Compiled Level 400 Training:** https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310\\r\\n\"},\"customWidth\":\"50\",\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Welcome\"},\"name\":\"Welcome\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1ad61717-0dd7-430b-a948-cef2d3618738\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Section\",\"label\":\"Select Section\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where tab == \\\"{Tab}\\\"\\r\\n| distinct section\\r\\n| serialize Rank = row_number()\\r\\n| project value = section, label = section, selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"\"},{\"id\":\"0c106e37-c059-4b2b-a80d-c4119629d1a9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Exercise\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"print tab = todynamic({json:value})\\r\\n| mvexpand parse_json(tab)\\r\\n| evaluate bag_unpack(tab)\\r\\n| where section == \\\"{Section}\\\" and tab == \\\"{Tab}\\\"\\r\\n| mvexpand exercises=(exercises.value)\\r\\n| evaluate bag_unpack(exercises)\\r\\n| extend packed = pack_all()\\r\\n| serialize Rank = row_number()\\r\\n| project\\r\\n value = tostring(packed),\\r\\n label = name,\\r\\n selected = iff(Rank == 1, true, false)\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"b2ae8bac-db12-4c75-8d3e-42c002d288d6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Dataset\",\"type\":2,\"isRequired\":true,\"isGlobal\":true,\"query\":\"let exercise = todynamic(\\\"{Exercise:escapejson}\\\");\\r\\nlet dataset = iff( isempty(exercise.dataset), \\\"Weather\\\", exercise.dataset);\\r\\ndatatable(tables:string)[\\\"{AllDatasets:escapejson}\\\"]\\r\\n| mvexpand todynamic(tables)\\r\\n| evaluate bag_unpack(tables)\\r\\n| extend kql = base64_decode_tostring(kql_reference)\\r\\n| serialize Rank = row_number()\\r\\n| project value = kql, label = name, selected = iff(name == dataset, true, false)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::1\"],\"showDefault\":false},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"2f5c56e7-dee3-46e7-b699-e331079e1d47\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Question\",\"type\":1,\"isGlobal\":true,\"query\":\"print(todynamic(\\\"{Exercise:escapejson}\\\").question)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"e5be7ed3-5eed-4b66-9db7-a0c2c132783b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Answer\",\"type\":1,\"isGlobal\":true,\"query\":\"let answer = todynamic(\\\"{Exercise:escapejson}\\\").answer;\\r\\nprint(base64_decode_tostring(tostring(answer)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"d4ecbbf3-25a0-4130-bc7d-50edead67b01\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Markdown\",\"type\":1,\"query\":\"let markdown = todynamic(\\\"{Exercise:escapejson}\\\").markdown;\\r\\nprint(base64_decode_tostring(tostring(markdown)))\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"4c94574f-3e3d-4d73-bed8-3eeebed298d3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowDoc\",\"label\":\"Show Documentation\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : true},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": false}\\r\\n]\",\"value\":\"No\"},{\"id\":\"ad9dc5ed-16a0-4157-88a2-bfe937e34e3a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ShowAnswer\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"label\":\"Show Answer\"},{\"id\":\"4f9a31b5-1f75-42af-85a7-c96af37a0d0c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LetDetected\",\"type\":1,\"query\":\"let result = iff(\\\"{Section}\\\" in ('Let','Union', 'Parse', 'Materialize', 'Function'), true, false);\\r\\nprint(result)\",\"isHiddenWhenLocked\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Error\",\"label\":\"Seeing Error\",\"type\":10,\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n {\\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\", \\\"selected\\\" : false},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\": true}\\r\\n]\",\"id\":\"9edc3ceb-a3a7-42bd-8ce1-e7ad666934e4\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"100\",\"name\":\"parameters - 4 - Copy\"},{\"type\":1,\"content\":{\"json\":\"## Fixing the Error\\r\\n\\r\\nThe error you are seeing is due to workbooks in Azure requiring external data sources to be marked as trusted. As this workbook pulls all of its content from GitHub, the repository must be marked as trusted. This is on a user session level and cannot be set within the workbook template. To fix the error:\\r\\n\\r\\n1. Go into edit mode.\\r\\n2. Under the hidden parameters at the top of the page, click edit.\\r\\n3. Check the box next to json.\\r\\n4. Click on the edit pencil icon.\\r\\n5. Click 'run query'.\\r\\n6. Click 'mark as trusted'.\\r\\n7. Click save.\\r\\n8. Exit edit mode.\\r\\n\\r\\nThe error should be gone and the content will be loaded.\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"Error\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 12\"},{\"type\":1,\"content\":{\"json\":\"The Kusto Query Language is the query language of choice within Microsoft Sentinel, Azure Log Analytics, and Azure Data Explorer. Kusto is similar to SQL in syntax and logic. The basic structure of Kusto appears as so:\\r\\n\\r\\nTable | operator clause/predicate\\r\\n\\r\\nThe table will specify which logs will be queried. The operator will dictate what type of filter, action, etc.\",\"style\":\"success\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"Overview\"},{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"}],\"name\":\"Welcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## {Section} - Exercise: {Exercise:label}\\r\\n\\r\\n{Markdown}\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowDoc\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"NotWelcome\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"\\r\\n![Question](https://shields.io/badge/-Question-informational)\\r\\n
{Question}\\r\\n
\"},\"customWidth\":\"50\",\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"text - 9\"},{\"type\":1,\"content\":{\"json\":\"Answer
\\r\\n\\r\\n```\\r\\n{Answer}\\r\\n```\"},\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"ShowAnswer\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"markdown - Copy\"}]},\"customWidth\":\"50\",\"name\":\"Question\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"341ea875-d1ff-4cbc-a9f6-421eeb82368c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Query\",\"type\":1,\"description\":\"Enter KQL query here to answer\",\"isRequired\":true,\"isGlobal\":true,\"typeSettings\":{\"multiLineText\":true,\"editorLanguage\":\"kql\",\"multiLineHeight\":7},\"criteriaData\":[{\"criteriaContext\":{\"operator\":\"Default\",\"resultValType\":\"static\",\"resultVal\":\"{Dataset:label} | limit 10\"}}],\"timeContext\":{\"durationMs\":86400000},\"label\":\"Put your answer here\"}],\"style\":\"formVertical\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"QueryControl\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Results\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Answer}\",\"size\":1,\"title\":\"Expected Results\",\"noDataMessage\":\"Had trouble producing the expected answer\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":500}},\"customWidth\":\"40\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HTarget\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let {Dataset:label} = () {{Dataset}};\\r\\n{Query}\",\"size\":1,\"title\":\"Your answer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Error\",\"formatter\":1,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}},{\"columnMatch\":\"code\",\"formatter\":5},{\"columnMatch\":\"message\",\"formatter\":5,\"formatOptions\":{\"customColumnWidthSetting\":\"90%\"}}],\"rowLimit\":500}},\"customWidth\":\"45\",\"conditionalVisibilities\":[{\"parameterName\":\"Stack\",\"comparison\":\"isNotEqualTo\",\"value\":\"Vertical\"},{\"parameterName\":\"Section\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"Exercise\",\"comparison\":\"isNotEqualTo\"}],\"name\":\"HResult\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let get_table_hash = (t:(*)) {\\r\\n t\\r\\n | project packed = pack_all()\\r\\n | summarize list = make_list(packed)\\r\\n | project hashvalue = hash(tostring(list))\\r\\n};\\r\\nlet check_tables_match = (table1:(*), table2:(*)) {\\r\\n get_table_hash(table1)\\r\\n | join get_table_hash(table2) on hashvalue\\r\\n | project match = iff(hashvalue == hashvalue1, true, false)\\r\\n};\\r\\nlet {Dataset:label} = () {{Dataset}};\\r\\nlet answer = {Query};\\r\\nlet correctAnswer = {Answer};\\r\\ncheck_tables_match(answer, correctAnswer)\",\"size\":4,\"noDataMessage\":\"Answer does not seem to be correct\",\"noDataMessageStyle\":4,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"match\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"icons\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"thresholdValue\":\"\",\"representation\":\"success\",\"text\":\"Answer is Correct\"}]}}],\"rowLimit\":500},\"graphSettings\":{\"type\":0}},\"customWidth\":\"15\",\"conditionalVisibilities\":[{\"parameterName\":\"Query\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},{\"parameterName\":\"Answer\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LetDetected\",\"comparison\":\"isEqualTo\"}],\"name\":\"Result\"},{\"type\":1,\"content\":{\"json\":\"This exercise includes use of a let statement which cannot be evaluated. Please manually validate if your answer matches the expected results\",\"style\":\"warning\"},\"customWidth\":\"15\",\"conditionalVisibility\":{\"parameterName\":\"LetDetected\",\"comparison\":\"isNotEqualTo\",\"value\":\"\"},\"name\":\"text - 3\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"Results\"},{\"type\":1,\"content\":{\"json\":\"Set the path to the Advanced KQL workbook in your environment. \\r\\n\\r\\nNote: If nothing is within the drop-down, you do not have the workbook deployed in your environment. You can find the workbook within the workbook gallery.\",\"style\":\"info\"},\"conditionalVisibilities\":[{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"String\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Anomalies\"},{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Misc\"}],\"customWidth\":\"50\",\"name\":\"text - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"crossComponentResources\":[\"value::selected\"],\"parameters\":[{\"id\":\"ed7e252c-2ae9-4be5-9e80-267b0274a9d9\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AdvancedKQLWorkbookPath\",\"type\":2,\"query\":\"resources\\r\\n| where type == \\\"microsoft.insights/workbooks\\\"\\r\\n| where properties.displayName has 'advanced KQL for microsoft sentinel'\\r\\n| extend path = trim('[]', id)\\r\\n| project path\\r\\n| take 1\",\"crossComponentResources\":[\"value::selected\"],\"value\":\"\",\"typeSettings\":{\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"}],\"style\":\"pills\",\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"name\":\"parameters - 10\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"list\",\"links\":[{\"id\":\"173f69f1-a9c0-4ebc-a497-3e7354a32236\",\"cellValue\":\"{AdvancedKQLWorkbookPath}\",\"linkTarget\":\"Resource\",\"linkLabel\":\"Advanced KQL Framework\",\"subTarget\":\"Workbook\",\"preText\":\"If you would like to study more advanced topics:\",\"style\":\"primary\",\"linkIsContextBlade\":true,\"workbookContext\":{\"componentIdSource\":\"parameter\",\"componentId\":\"AdvancedKQLPath\",\"resourceIdsSource\":\"parameter\",\"resourceIds\":\"AdvancedKQLPath\",\"templateIdSource\":\"parameter\",\"templateId\":\"AdvancedKQLPath\",\"typeSource\":\"workbook\",\"gallerySource\":\"workbook\",\"locationSource\":\"default\"}},{\"id\":\"690a89fe-5c1d-4313-b442-ce059670840f\",\"cellValue\":\"https://aka.ms/lademo\",\"linkTarget\":\"OpenBlade\",\"linkLabel\":\"ALA Demo\",\"preText\":\"If you would like to test any of the lessons learned, you can use the ALA Demo workspace here: \",\"style\":\"primary\",\"linkIsContextBlade\":true,\"bladeOpenContext\":{\"bladeName\":\"DemoLogsBlade\",\"extensionName\":\"Microsoft_Azure_Monitoring_Logs\"}},{\"id\":\"295f7752-374b-4680-b281-c5cb8b83d384\",\"cellValue\":\"https://aka.ms/introtokqlsurvey\",\"linkTarget\":\"Url\",\"linkLabel\":\"Feedback Form\",\"preText\":\"If you would like to submit feedback for this solution, please click on the form link here: \",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isNotEqualTo\",\"value\":\"Welcome\"},\"customWidth\":\"50\",\"name\":\"links - 9\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"IntrotoKQL\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
"version": "1.0",
"sourceId": "[variables('workspaceResourceId')]",
"category": "sentinel"