diff --git a/Solutions/Microsoft PowerBI/Data Connectors/template_OfficePowerBI.JSON b/Solutions/Microsoft PowerBI/Data Connectors/template_OfficePowerBI.JSON index ff1c03ce222..856e5e239dd 100644 --- a/Solutions/Microsoft PowerBI/Data Connectors/template_OfficePowerBI.JSON +++ b/Solutions/Microsoft PowerBI/Data Connectors/template_OfficePowerBI.JSON @@ -28,7 +28,7 @@ ], "availability": { "status": 1, - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ diff --git a/Solutions/Microsoft PowerBI/Data/system_generated_metadata.json b/Solutions/Microsoft PowerBI/Data/system_generated_metadata.json new file mode 100644 index 00000000000..721a72cc197 --- /dev/null +++ b/Solutions/Microsoft PowerBI/Data/system_generated_metadata.json @@ -0,0 +1,30 @@ +{ + "Name": "Microsoft PowerBI", + "Author": "Microsoft", + "Logo": "", + "Description": "The [Microsoft PowerBI](https://docs.microsoft.com/power-bi/fundamentals/power-bi-overview) solution enables you to track user activities in your PowerBI environment. You can filter the audit data by date range, user, dashboard, report, dataset, and activity type.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\na. [Office Management API ](https://docs.microsoft.com/office/office-365-management-api/office-365-management-apis-overview)", + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft PowerBI", + "TemplateSpec": true, + "Is1PConnector": true, + "Version": "3.0.0", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-microsoftpowerbi", + "providers": [ + "Microsoft" + ], + "categories": { + "domains": [ + "Application" + ] + }, + "firstPublishDate": "2022-05-23", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "Data Connectors": "[\n \"Data Connectors/template_OfficePowerBI.JSON\"\n]", + "Workbooks": "[\n \"Workbooks/MicrosoftPowerBIActivityWorkbook.json\"\n]" +} diff --git a/Solutions/Microsoft PowerBI/Package/3.0.0.zip b/Solutions/Microsoft PowerBI/Package/3.0.0.zip new file mode 100644 index 00000000000..0da71ed3a12 Binary files /dev/null and b/Solutions/Microsoft PowerBI/Package/3.0.0.zip differ diff --git a/Solutions/Microsoft PowerBI/Package/createUiDefinition.json b/Solutions/Microsoft PowerBI/Package/createUiDefinition.json index 76c1ec0eddd..bbf59fa1cef 100644 --- a/Solutions/Microsoft PowerBI/Package/createUiDefinition.json +++ b/Solutions/Microsoft PowerBI/Package/createUiDefinition.json @@ -124,4 +124,4 @@ "workspace": "[basics('workspace')]" } } -} \ No newline at end of file +} diff --git a/Solutions/Microsoft PowerBI/Package/mainTemplate.json b/Solutions/Microsoft PowerBI/Package/mainTemplate.json index 9c6c796613b..845c1580cbc 100644 --- a/Solutions/Microsoft PowerBI/Package/mainTemplate.json +++ b/Solutions/Microsoft PowerBI/Package/mainTemplate.json @@ -40,50 +40,37 @@ "variables": { "solutionId": "azuresentinel.azure-sentinel-solution-microsoftpowerbi", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionName": "Microsoft PowerBI", + "_solutionVersion": "3.0.0", "uiConfigId1": "OfficePowerBI", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "OfficePowerBI", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "MicrosoftPowerBIActivityWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Microsoft PowerBI data connector with template", - "displayName": "Microsoft PowerBI template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Microsoft PowerBI data connector with template version 2.0.1", + "description": "Microsoft PowerBI data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -128,7 +115,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -152,12 +139,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Microsoft PowerBI", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -221,33 +219,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Microsoft PowerBI Workbook with template", - "displayName": "Microsoft PowerBI workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MicrosoftPowerBIActivityWorkbookWorkbook Workbook with template version 2.0.1", + "description": "MicrosoftPowerBIActivityWorkbookWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -265,7 +245,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ccd5adcd-8d59-4cfe-99ec-98075de2e253\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"1ca69445-60fc-4806-b43d-ac7e6aad630a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"e94aafa3-c5d9-4523-89f0-4e87aa754511\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\n| project id\",\"crossComponentResources\":[\"{Subscription}\"],\"value\":\"\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true}},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"eafaa0ec-7c3a-4ee5-babe-9850080c909d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"resourceGroup\",\"type\":1,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| where id == \\\"{Workspace}\\\"\\r\\n| project resourceGroup\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"c4b69c01-2263-4ada-8d9c-43433b739ff3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":false},\"value\":{\"durationMs\":7776000000}},{\"id\":\"c71f3009-a3f4-4aa5-aaf0-d0f667100e56\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"description\":\"This will show some help information to help you understand the page you are on\",\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }]\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":1,\"content\":{\"json\":\"# Microsoft PowerBI Activity Workbook\"},\"name\":\"text - 11\"},{\"type\":1,\"content\":{\"json\":\"#### Please select subscription and workspace for the workbook to load.\\r\\n#### Please change the TimeRange to relead the datasets between different timeframe.\\r\\n\\r\\n#### This workbook contains\\r\\n- Overview \\r\\n\\t- Activity Over Time \\r\\n\\t- Events Occured\\r\\n\\t- Workspace Used\\r\\n\\t- Report Accessed\\r\\n\\t- Dataset Accessed\\r\\n\\t- Activity by DistributionMethod\\r\\n\\t- Activity through UserAgent\\r\\n- Datasets\\r\\n\\t- Dataset Directly Accessed\\r\\n\\t- Activity Directly on Datastes\\r\\n\\t- Direct Datasets Activities\\r\\n- Reports\\r\\n\\t- Activities Across Reports\\r\\n- IP and User Activity Trend\\r\\n\\t- IP Address Activity Trend\\r\\n\\t- User Activity Trend\\r\\n\\t- User Activity Across IP Addresses\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 11 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### Overview\",\"style\":\"info\"},\"name\":\"text - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by Activity, bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Activity Over Time for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by Activity\",\"size\":0,\"title\":\"Events Occured for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 6 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by PbiWorkspaceName\",\"size\":0,\"title\":\"Workspace Used for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by ReportName\",\"size\":0,\"title\":\"Report Accessed for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"ReportName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by DatasetName\",\"size\":0,\"title\":\"Dataset used for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by DistributionMethod\",\"size\":0,\"title\":\"Activity by DistributionMethod for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by UserAgent\",\"size\":0,\"title\":\"Activity through UserAgent for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 19 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### Datasets\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| where isempty(ReportName) and isnotempty(DatasetName)\\r\\n|summarize count() by DatasetName\",\"size\":0,\"title\":\"Dataset dircetly accessed for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| where isempty(ReportName) and isnotempty(DatasetName)\\r\\n| summarize count() by Activity\",\"size\":0,\"title\":\"Activity directly on Datasets for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| where isnotempty(DatasetName)\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by DatasetName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n| where isnotempty(DatasetName)\\r\\n|summarize TotalActivity = count(), CreateDataset = countif(Activity ==\\\"CreateDataset\\\"),UpdateDatasetParameters\\r\\n = countif(Activity ==\\\"UpdateDatasetParameters\\\") by DatasetName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on DatasetName\",\"size\":0,\"title\":\"Direct Datasets Activities for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"DatasetName1\",\"formatter\":5},{\"columnMatch\":\"TotalActivity\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"CreateDataset\",\"formatter\":4,\"formatOptions\":{\"palette\":\"greenDarkDark\"}},{\"columnMatch\":\"UpdateDatasetParameters\",\"formatter\":4,\"formatOptions\":{\"palette\":\"brown\"}}],\"filter\":true}},\"name\":\"query - 13\"},{\"type\":1,\"content\":{\"json\":\"### Reports\",\"style\":\"info\"},\"name\":\"text - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| where isnotempty(DatasetName) and isnotempty(ReportName)\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ReportName, DatasetName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n| where isnotempty(DatasetName) and isnotempty(ReportName)\\r\\n|summarize TotalActivity = count(), ViewReport = countif(Activity ==\\\"ViewReport\\\"),CreateReport = countif(Activity ==\\\"CreateReport\\\") by ReportName, DatasetName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on ReportName,DatasetName\",\"size\":0,\"title\":\"Activities Across Reports for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Group\",\"formatter\":1},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"ReportName1\",\"formatter\":5},{\"columnMatch\":\"DatasetName1\",\"formatter\":5},{\"columnMatch\":\"TotalActivity\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ViewReport\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"CreateReport\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ReportName\"],\"expandTopLevel\":true}}},\"name\":\"query - 13 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### IP and User Activity Trend\",\"style\":\"info\"},\"name\":\"text - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SrcIpAddr);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n|summarize count() by SrcIpAddr);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on SrcIpAddr\",\"size\":0,\"title\":\"IP Address Activity Trend for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"SrcIpAddr1\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ActorName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n|summarize count() by ActorName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on ActorName\",\"size\":0,\"title\":\"User Activity Trend for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"ActorName1\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by ActorName, SrcIpAddr\",\"size\":0,\"title\":\"User Activity Across IP Addresses for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Group\",\"formatter\":1},{\"columnMatch\":\"SrcIpAddr\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ActorName\"]}}},\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\"}],\"fromTemplateId\":\"sentinel-MicrosoftPowerBIActivityWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ccd5adcd-8d59-4cfe-99ec-98075de2e253\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DefaultSubscription_Internal\",\"type\":1,\"isRequired\":true,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| take 1\\r\\n| project subscriptionId\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"1ca69445-60fc-4806-b43d-ac7e6aad630a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Subscription\",\"type\":6,\"query\":\"summarize by subscriptionId\\r\\n| project value = strcat(\\\"/subscriptions/\\\", subscriptionId), label = subscriptionId, selected = iff(subscriptionId =~ '{DefaultSubscription_Internal}', true, false)\\r\\n\",\"crossComponentResources\":[\"value::selected\"],\"typeSettings\":{\"showDefault\":false},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"e94aafa3-c5d9-4523-89f0-4e87aa754511\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Workspace\",\"type\":5,\"query\":\"where type =~ 'microsoft.operationalinsights/workspaces'\\n| project id\",\"crossComponentResources\":[\"{Subscription}\"],\"value\":\"\",\"typeSettings\":{\"resourceTypeFilter\":{\"microsoft.operationalinsights/workspaces\":true}},\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"eafaa0ec-7c3a-4ee5-babe-9850080c909d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"resourceGroup\",\"type\":1,\"query\":\"resources\\r\\n| where type =~ 'microsoft.operationalinsights/workspaces'\\r\\n| where id == \\\"{Workspace}\\\"\\r\\n| project resourceGroup\",\"crossComponentResources\":[\"value::selected\"],\"isHiddenWhenLocked\":true,\"queryType\":1,\"resourceType\":\"microsoft.resourcegraph/resources\"},{\"id\":\"c4b69c01-2263-4ada-8d9c-43433b739ff3\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":false},\"value\":{\"durationMs\":7776000000}},{\"id\":\"c71f3009-a3f4-4aa5-aaf0-d0f667100e56\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Help\",\"label\":\"Show Help\",\"type\":10,\"description\":\"This will show some help information to help you understand the page you are on\",\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{ \\\"value\\\": \\\"Yes\\\", \\\"label\\\": \\\"Yes\\\"},\\r\\n {\\\"value\\\": \\\"No\\\", \\\"label\\\": \\\"No\\\", \\\"selected\\\":true }]\"}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":1,\"content\":{\"json\":\"# Microsoft PowerBI Activity Workbook\"},\"name\":\"text - 11\"},{\"type\":1,\"content\":{\"json\":\"#### Please select subscription and workspace for the workbook to load.\\r\\n#### Please change the TimeRange to relead the datasets between different timeframe.\\r\\n\\r\\n#### This workbook contains\\r\\n- Overview \\r\\n\\t- Activity Over Time \\r\\n\\t- Events Occured\\r\\n\\t- Workspace Used\\r\\n\\t- Report Accessed\\r\\n\\t- Dataset Accessed\\r\\n\\t- Activity by DistributionMethod\\r\\n\\t- Activity through UserAgent\\r\\n- Datasets\\r\\n\\t- Dataset Directly Accessed\\r\\n\\t- Activity Directly on Datastes\\r\\n\\t- Direct Datasets Activities\\r\\n- Reports\\r\\n\\t- Activities Across Reports\\r\\n- IP and User Activity Trend\\r\\n\\t- IP Address Activity Trend\\r\\n\\t- User Activity Trend\\r\\n\\t- User Activity Across IP Addresses\"},\"conditionalVisibility\":{\"parameterName\":\"Help\",\"comparison\":\"isEqualTo\",\"value\":\"Yes\"},\"name\":\"text - 11 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### Overview\",\"style\":\"info\"},\"name\":\"text - 16\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by Activity, bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"title\":\"Activity Over Time for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"query - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by Activity\",\"size\":0,\"title\":\"Events Occured for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 6 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by PbiWorkspaceName\",\"size\":0,\"title\":\"Workspace Used for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by ReportName\",\"size\":0,\"title\":\"Report Accessed for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"ReportName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by DatasetName\",\"size\":0,\"title\":\"Dataset used for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by DistributionMethod\",\"size\":0,\"title\":\"Activity by DistributionMethod for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| summarize count() by UserAgent\",\"size\":0,\"title\":\"Activity through UserAgent for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"query - 19 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### Datasets\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| where isempty(ReportName) and isnotempty(DatasetName)\\r\\n|summarize count() by DatasetName\",\"size\":0,\"title\":\"Dataset dircetly accessed for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n| where isempty(ReportName) and isnotempty(DatasetName)\\r\\n| summarize count() by Activity\",\"size\":0,\"title\":\"Activity directly on Datasets for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DatasetName\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| where isnotempty(DatasetName)\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by DatasetName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n| where isnotempty(DatasetName)\\r\\n|summarize TotalActivity = count(), CreateDataset = countif(Activity ==\\\"CreateDataset\\\"),UpdateDatasetParameters\\r\\n = countif(Activity ==\\\"UpdateDatasetParameters\\\") by DatasetName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on DatasetName\",\"size\":0,\"title\":\"Direct Datasets Activities for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":21,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"DatasetName1\",\"formatter\":5},{\"columnMatch\":\"TotalActivity\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"CreateDataset\",\"formatter\":4,\"formatOptions\":{\"palette\":\"greenDarkDark\"}},{\"columnMatch\":\"UpdateDatasetParameters\",\"formatter\":4,\"formatOptions\":{\"palette\":\"brown\"}}],\"filter\":true}},\"name\":\"query - 13\"},{\"type\":1,\"content\":{\"json\":\"### Reports\",\"style\":\"info\"},\"name\":\"text - 18\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| where isnotempty(DatasetName) and isnotempty(ReportName)\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ReportName, DatasetName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n| where isnotempty(DatasetName) and isnotempty(ReportName)\\r\\n|summarize TotalActivity = count(), ViewReport = countif(Activity ==\\\"ViewReport\\\"),CreateReport = countif(Activity ==\\\"CreateReport\\\") by ReportName, DatasetName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on ReportName,DatasetName\",\"size\":0,\"title\":\"Activities Across Reports for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Group\",\"formatter\":1},{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"ReportName1\",\"formatter\":5},{\"columnMatch\":\"DatasetName1\",\"formatter\":5},{\"columnMatch\":\"TotalActivity\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"ViewReport\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"CreateReport\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ReportName\"],\"expandTopLevel\":true}}},\"name\":\"query - 13 - Copy\"},{\"type\":1,\"content\":{\"json\":\"### IP and User Activity Trend\",\"style\":\"info\"},\"name\":\"text - 19\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by SrcIpAddr);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n|summarize count() by SrcIpAddr);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on SrcIpAddr\",\"size\":0,\"title\":\"IP Address Activity Trend for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"SrcIpAddr1\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let PbiTrend = (PowerBIActivity\\r\\n| make-series Trend = count() default = 0 on TimeGenerated in range({TimeRange:start}, {TimeRange:end}, {TimeRange:grain}) by ActorName);\\r\\nlet PbiSummary = (PowerBIActivity\\r\\n|summarize count() by ActorName);\\r\\nPbiTrend\\r\\n| join kind=inner(\\r\\nPbiSummary\\r\\n) on ActorName\",\"size\":0,\"title\":\"User Activity Trend for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"TimeGenerated\",\"formatter\":5},{\"columnMatch\":\"ActorName1\",\"formatter\":5},{\"columnMatch\":\"count_\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true}},\"customWidth\":\"50\",\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PowerBIActivity\\r\\n|summarize count() by ActorName, SrcIpAddr\",\"size\":0,\"title\":\"User Activity Across IP Addresses for {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Group\",\"formatter\":1},{\"columnMatch\":\"SrcIpAddr\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}],\"filter\":true,\"hierarchySettings\":{\"treeType\":1,\"groupBy\":[\"ActorName\"]}}},\"name\":\"query - 6 - Copy - Copy - Copy - Copy - Copy - Copy - Copy\"}],\"fromTemplateId\":\"sentinel-MicrosoftPowerBIActivityWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -303,7 +283,7 @@ "kind": "DataType" }, { - "contentId": "OfficePowerBI", + "contentId": "Microsoft PowerBI (Preview)", "kind": "DataConnector" } ] @@ -311,17 +291,35 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.1", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Microsoft PowerBI", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Microsoft PowerBI solution enables you to track user activities in your PowerBI environment. You can filter the audit data by date range, user, dashboard, report, dataset, and activity type.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Office Management API
    2. \n
\n

Data Connectors: 1, Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { diff --git a/Solutions/Microsoft Project/Data Connectors/template_Office365Project.JSON b/Solutions/Microsoft Project/Data Connectors/template_Office365Project.JSON index eb158ee9805..f4ca033b0e7 100644 --- a/Solutions/Microsoft Project/Data Connectors/template_Office365Project.JSON +++ b/Solutions/Microsoft Project/Data Connectors/template_Office365Project.JSON @@ -33,7 +33,7 @@ ], "availability": { "status": 1, - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [