diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..003ff8e --- /dev/null +++ b/.editorconfig @@ -0,0 +1,18 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true + +[*.{workbook,json}] +indent_style = space +indent_size = 2 + +[*.py] +indent_style = space +indent_size = 4 + +[*.md] +trim_trailing_whitespace = false diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..9fbc962 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,11 @@ +# Workbook templates are JSON; tell GitHub to highlight and diff them as such. +*.workbook linguist-language=JSON text eol=lf + +# Keep generated and source files on LF so diffs stay clean across platforms. +*.md text eol=lf +*.py text eol=lf +*.yml text eol=lf +*.json text eol=lf + +# The catalog is generated by scripts/build_catalog.py. +CATALOG.md linguist-generated=true diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml new file mode 100644 index 0000000..5b65fac --- /dev/null +++ b/.github/workflows/validate.yml @@ -0,0 +1,29 @@ +name: Validate workbooks + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + validate: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-python@v5 + with: + python-version: "3.12" + + - name: Validate workbook JSON and check for leaked resource IDs + run: python scripts/validate_workbooks.py + + - name: Check placeholders are in use + run: python scripts/scrub_resource_ids.py --check + + - name: Check CATALOG.md is up to date + run: python scripts/build_catalog.py --check diff --git a/Authoring, Templates & Examples/FindmySyntax v0.2.3.workbook b/Authoring, Templates & Examples/FindmySyntax v0.2.3.workbook index 010c9a9..0b2a806 100644 --- a/Authoring, Templates & Examples/FindmySyntax v0.2.3.workbook +++ b/Authoring, Templates & Examples/FindmySyntax v0.2.3.workbook @@ -36,7 +36,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecuritySOC" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "9fa77675-1222-4936-89d0-285da325bba0", diff --git a/Authoring, Templates & Examples/api test v1-2.workbook b/Authoring, Templates & Examples/api test v1-2.workbook index 6e457a1..46f870d 100644 --- a/Authoring, Templates & Examples/api test v1-2.workbook +++ b/Authoring, Templates & Examples/api test v1-2.workbook @@ -30,7 +30,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/api test v1-4.1.workbook b/Authoring, Templates & Examples/api test v1-4.1.workbook index e2448c2..809d73b 100644 --- a/Authoring, Templates & Examples/api test v1-4.1.workbook +++ b/Authoring, Templates & Examples/api test v1-4.1.workbook @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecuritySoc", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/api test v1.4.2.workbook b/Authoring, Templates & Examples/api test v1.4.2.workbook index 227ded5..dc44328 100644 --- a/Authoring, Templates & Examples/api test v1.4.2.workbook +++ b/Authoring, Templates & Examples/api test v1.4.2.workbook @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/82931e73-05c6-4da8-a666-bc4a7dd1bd3e/resourceGroups/fabrikamltdprodrg/providers/Microsoft.OperationalInsights/workspaces/fabrikamltdprod", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/api test v1.4.3.workbook b/Authoring, Templates & Examples/api test v1.4.3.workbook index 46598d9..6db8bfa 100644 --- a/Authoring, Templates & Examples/api test v1.4.3.workbook +++ b/Authoring, Templates & Examples/api test v1.4.3.workbook @@ -11,7 +11,7 @@ "version": "KqlParameterItem/1.0", "name": "Subscription", "type": 6, - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000", "typeSettings": { "additionalResourceOptions": [], "includeAll": false @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecuritySOC", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/api test v1.4.4 (1).workbook b/Authoring, Templates & Examples/api test v1.4.4 (1).workbook index f8a46da..08115f4 100644 --- a/Authoring, Templates & Examples/api test v1.4.4 (1).workbook +++ b/Authoring, Templates & Examples/api test v1.4.4 (1).workbook @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/api test v1.4.5 (2).workbook b/Authoring, Templates & Examples/api test v1.4.5 (2).workbook index 7151473..809e0af 100644 --- a/Authoring, Templates & Examples/api test v1.4.5 (2).workbook +++ b/Authoring, Templates & Examples/api test v1.4.5 (2).workbook @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/82931e73-05c6-4da8-a666-bc4a7dd1bd3e/resourceGroups/fabrikamltdprodrg/providers/Microsoft.OperationalInsights/workspaces/fabrikamltdprod", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Authoring, Templates & Examples/withHelpandTabsandGroups.workbook b/Authoring, Templates & Examples/withHelpandTabsandGroups.workbook index 70da0ce..e95f2ef 100644 --- a/Authoring, Templates & Examples/withHelpandTabsandGroups.workbook +++ b/Authoring, Templates & Examples/withHelpandTabsandGroups.workbook @@ -46,7 +46,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/04a8ebe3-0389-4b0f-8461-30f81896e97e/resourceGroups/weu-management-rg/providers/Microsoft.OperationalInsights/workspaces/pcadmintest" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "9fa77675-1222-4936-89d0-285da325bba0", diff --git a/CATALOG.md b/CATALOG.md new file mode 100644 index 0000000..c71b284 --- /dev/null +++ b/CATALOG.md @@ -0,0 +1,919 @@ +# Workbook Catalog + +_Generated by `scripts/build_catalog.py`; do not edit by hand. Run `python scripts/build_catalog.py` after adding or changing workbooks._ + +Titles are read from the first Markdown heading inside each workbook. Files that share a name with a numeric suffix (for example `Cluster (3).workbook`) are distinct templates that happened to be exported under the same name; use the title and parameters to tell them apart. + +## Categories + +| Category | Workbooks | +| --- | ---: | +| [AI & Machine Learning](#ai--machine-learning) | 10 | +| [Application Insights & APM](#application-insights--apm) | 37 | +| [Authoring, Templates & Examples](#authoring-templates--examples) | 31 | +| [Compute & Containers](#compute--containers) | 106 | +| [Databases & Data](#databases--data) | 105 | +| [Endpoint & Intune](#endpoint--intune) | 11 | +| [Identity & Access](#identity--access) | 45 | +| [Integration & Messaging](#integration--messaging) | 33 | +| [IoT](#iot) | 8 | +| [Monitoring & Management](#monitoring--management) | 184 | +| [Networking](#networking) | 67 | +| [SAP & Industry Workloads](#sap--industry-workloads) | 70 | +| [Security, Sentinel & Defender](#security-sentinel--defender) | 68 | +| [Storage & Backup](#storage--backup) | 49 | +| **Total** | **824** | + +## AI & Machine Learning + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [AI-Studio-Insights.workbook](AI%20%26%20Machine%20Learning/AI-Studio-Insights.workbook) | Insights for Generative AI applications(Preview) | TimeRange, AzureAIProject, ApplicationInsights, AzureAIHub | 47 | +| [CognitiveServicesOverview.workbook](AI%20%26%20Machine%20Learning/CognitiveServicesOverview.workbook) | Azure OpenAI & Cognitive Services — Cross-Subscription Metrics | Subscriptions, Resources, TimeRange, Aggregation, ModelName, ModelDeploymentName | 26 | +| [CopilotStudioDashboard.workbook](AI%20%26%20Machine%20Learning/CopilotStudioDashboard.workbook) | CopilotStudioDashboard | TimeRange, CopilotAgent, ChannelFilter, IncludeTestData, AppInsights | 18 | +| [Experiment Analysis.workbook](AI%20%26%20Machine%20Learning/Experiment%20Analysis.workbook) | If no analysis result report is displayed below, please verify that the correct Azure sub… | HideWorkspace, HideTimeRange, HideFeatureFlag, HideExperiment, HideLabel, AppConfigEndpoint | 15 | +| [Experiment Status.workbook](AI%20%26%20Machine%20Learning/Experiment%20Status.workbook) | If no analysis result report is displayed below, please verify that the correct Azure sub… | HideWorkspace, HideLabel, AppConfigEndpoint | 6 | +| [FoundryDashboard.workbook](AI%20%26%20Machine%20Learning/FoundryDashboard.workbook) | FoundryDashboard | TimeRange, AzureAIProject, ApplicationInsights, Model, Application | 15 | +| [Line Crossing.workbook](AI%20%26%20Machine%20Learning/Line%20Crossing.workbook) | Line Crossing | Workspace, TimeRange, ErrorHandle | 6 | +| [Metric Explorer.workbook](AI%20%26%20Machine%20Learning/Metric%20Explorer.workbook) | This workbook provides basic monitoring of the custom events logged by your application. | _Source | 18 | +| [Object Detection.workbook](AI%20%26%20Machine%20Learning/Object%20Detection.workbook) | Person Detection | Workspace, TimeRange, ErrorHandle | 6 | +| [People Counting.workbook](AI%20%26%20Machine%20Learning/People%20Counting.workbook) | People Counting | Workspace, TimeRange, ErrorHandle | 6 | + +## Application Insights & APM + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [Active Users.workbook](Application%20Insights%20%26%20APM/Active%20Users.workbook) | Active Users | Metric, Activities, OtherFilters | 8 | +| [Agents - Overview.workbook](Application%20Insights%20%26%20APM/Agents%20-%20Overview.workbook) | Agent Runs | TimeRange, ResourceId, selectedTab, GenAIDataCheck, EvaluationDataCheck, CostDataCheck, … | 57 | +| [Analysis of Page Views.workbook](Application%20Insights%20%26%20APM/Analysis%20of%20Page%20Views.workbook) | Analysis of Page Views | TimeRange, Pages, OtherFilters, OptimizeCalculationsFor | 21 | +| [Apdex.workbook](Application%20Insights%20%26%20APM/Apdex.workbook) | Apdex | Type, Operations, TimeRange, OperationsFilter, ApdexThresholdInMilliseconds, Calculations | 11 | +| [Authenticated User Timelines.workbook](Application%20Insights%20%26%20APM/Authenticated%20User%20Timelines.workbook) | Sample Users | TimeRange, Activities, Show | 7 | +| [Downtime Outages.workbook](Application%20Insights%20%26%20APM/Downtime%20Outages.workbook) | Do not set the Maintenance Window to a full day | Subscriptions, Resource_Group, Resources, TimeRange, WebTests, Target_Nines | 31 | +| [Engaged Users.workbook](Application%20Insights%20%26%20APM/Engaged%20Users.workbook) | Engaged Users | Activities, Period, DaysUsed, CustomDaysUsed, TimeRange | 6 | +| [Failure Insights.workbook](Application%20Insights%20%26%20APM/Failure%20Insights.workbook) | Failures Insights | Apps, TimeRange, Operation | 11 | +| [HEART Analytics - All Sections.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20-%20All%20Sections.workbook) | No Resource is selected. Please select a value from the Resource parameter. | Resource | 40 | +| [HEART Analytics Section - Adoption.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Adoption.workbook) | Adoption | — | 12 | +| [HEART Analytics Section - Engagement.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Engagement.workbook) | Engagement | — | 13 | +| [HEART Analytics Section - Feature Drill-Down.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Feature%20Drill-Down.workbook) | Feature Metrics | — | 18 | +| [HEART Analytics Section - Happiness.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Happiness.workbook) | Happiness | — | 12 | +| [HEART Analytics Section - Retention.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Retention.workbook) | Retention | — | 10 | +| [HEART Analytics Section - Task Success.workbook](Application%20Insights%20%26%20APM/HEART%20Analytics%20Section%20-%20Task%20Success.workbook) | Task Success | — | 16 | +| [Improving User Retention.workbook](Application%20Insights%20%26%20APM/Improving%20User%20Retention.workbook) | Hypothesis - [proposed change] will improve user retention by [expected improvement] | Activities, RetentionPeriod, TimeRange | 23 | +| [Increasing Active Users.workbook](Application%20Insights%20%26%20APM/Increasing%20Active%20Users.workbook) | Hypothesis - [proposed change] will increase active users by [expected improvement] | Activities, Metric, TimeRange | 21 | +| [New Failures Analysis.workbook](Application%20Insights%20%26%20APM/New%20Failures%20Analysis.workbook) | New Failures Analysis | Show, In, OverTimeRange, UseComparisonTimeRangeOf | 26 | +| [New, Returning and Churned Users.workbook](Application%20Insights%20%26%20APM/New%2C%20Returning%20and%20Churned%20Users.workbook) | New, Returning and Churned Users | Metric, Activities, OtherFilters, TimeRange | 13 | +| [Performance Counter Analysis.workbook](Application%20Insights%20%26%20APM/Performance%20Counter%20Analysis.workbook) | Performance Counter Analysis | PerformanceCounter, AnalysisWindow, RollingTimeWindow, ChartGrain, Machines, Instances | 9 | +| [Performance Insights.workbook](Application%20Insights%20%26%20APM/Performance%20Insights.workbook) | Application Performance Insights | Apps, TimeRange, Operation, Columns | 18 | +| [Retention - N Period.workbook](Application%20Insights%20%26%20APM/Retention%20-%20N%20Period.workbook) | N-Period Retention | CohortingActivities, CohortingFilters, RetainingActivities, RetainingFilters | 8 | +| [SDKStats.workbook](Application%20Insights%20%26%20APM/SDKStats.workbook) | SDK Stats | TimeRange, SdkVersion, SelectedMetric, SelectedTimeBucket, DropReason, DropCode, … | 17 | +| [Segmented Funnel.workbook](Application%20Insights%20%26%20APM/Segmented%20Funnel.workbook) | Segmented Funnel | TimeRange, ConversionScope | 8 | +| [Single Page Application Website Insights.workbook](Application%20Insights%20%26%20APM/Single%20Page%20Application%20Website%20Insights.workbook) | This workbook is deprecated. | has_Mezzurite_Data | 16 | +| [Usage - Events.workbook](Application%20Insights%20%26%20APM/Usage%20-%20Events.workbook) | ---- | componentId, TimeRange, timeRangeStringEscape, UsersList, Whoused, itemTypeNumber, … | 10 | +| [Usage - Funnels.workbook](Application%20Insights%20%26%20APM/Usage%20-%20Funnels.workbook) | No data found. | TimeRange, TopNumber, usageStandardDimension, getCustomDimensions, formattedCustomDimensions, commonFilterDimensions, … | 67 | +| [Usage - MoreEvents.workbook](Application%20Insights%20%26%20APM/Usage%20-%20MoreEvents.workbook) | {TimeRange} | eventValues, workbookParams | 15 | +| [Usage - MoreSessions.workbook](Application%20Insights%20%26%20APM/Usage%20-%20MoreSessions.workbook) | {TimeRange} | eventValues, workbookParams | 14 | +| [Usage - MoreUsers.workbook](Application%20Insights%20%26%20APM/Usage%20-%20MoreUsers.workbook) | {TimeRange} | configFlag | 20 | +| [Usage - Sessions.workbook](Application%20Insights%20%26%20APM/Usage%20-%20Sessions.workbook) | ---- | componentId, TimeRange, timeRangeStringEscape, UsersList, Whoused, itemTypeNumber, … | 10 | +| [Usage - UsageFilters.workbook](Application%20Insights%20%26%20APM/Usage%20-%20UsageFilters.workbook) | Usage - UsageFilters | FilterDimension1, FilterOperator1, FilterValues1text, FilterDimension1s, isFilter1Completed, FilterValues1, … | 5 | +| [Usage - Users.workbook](Application%20Insights%20%26%20APM/Usage%20-%20Users.workbook) | ---- | componentId, TimeRange, timeRangeStringEscape, UsersList, Whoused, itemTypeNumber, … | 10 | +| [Usage by hours of the day.workbook](Application%20Insights%20%26%20APM/Usage%20by%20hours%20of%20the%20day.workbook) | Usage through the day | Activities, TimeRange, Metric, ExcludeWeekends | 3 | +| [Usage Calendar.workbook](Application%20Insights%20%26%20APM/Usage%20Calendar.workbook) | Usage Calendar | Activities, TimeRange, Metric, ExcludeWeekends | 6 | +| [User Impact Analysis.workbook](Application%20Insights%20%26%20APM/User%20Impact%20Analysis.workbook) | {correlationText} | TimeRange, SelectEvent, usageStandardDimension, getCustomDimensions, formattedCustomDimensions, BucketItem, … | 18 | +| [User Retention Analysis.workbook](Application%20Insights%20%26%20APM/User%20Retention%20Analysis.workbook) | User Retention Analysis | TimeRange, WhoUsed, UserEvents, ReturnWhoUsed, ReturnUserEvents, ExtendColumn, … | 18 | + +## Authoring, Templates & Examples + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [_api test v1.4.6 (1).workbook](Authoring%2C%20Templates%20%26%20Examples/_api%20test%20v1.4.6%20%281%29.workbook) | Please select a Time Range: use [Incident Time select] parameter above | Subscription, Workspace, resourceGroup, top, apiTimeRange, Help | 23 | +| [api example v0-1.workbook](Authoring%2C%20Templates%20%26%20Examples/api%20example%20v0-1.workbook) | Sentinel API query examples | Subscription, Workspace, resourceGroup | 8 | +| [api test v1-2.workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1-2.workbook) | Sentinel API query examples | Subscription, Workspace, resourceGroup | 9 | +| [api test v1-4.1.workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1-4.1.workbook) | Sentinel API query examples | Subscription, Workspace, resourceGroup | 9 | +| [api test v1.4.2.workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1.4.2.workbook) | Sentinel API query examples | Subscription, Workspace, resourceGroup, top | 11 | +| [api test v1.4.3.workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1.4.3.workbook) | Sentinel API query examples. This is to show the options rather than a full solution. Ple… | Subscription, Workspace, resourceGroup, top | 15 | +| [api test v1.4.4 (1).workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1.4.4%20%281%29.workbook) | Sentinel API query examples. This is to show the options rather than a full solution. Ple… | Subscription, Workspace, resourceGroup, top, apiTimeRange | 16 | +| [api test v1.4.5 (2).workbook](Authoring%2C%20Templates%20%26%20Examples/api%20test%20v1.4.5%20%282%29.workbook) | Please select a Time Range: use [Incident Time select] parameter above | Subscription, Workspace, resourceGroup, top, apiTimeRange, Help | 22 | +| [Archive Log Tool .workbook](Authoring%2C%20Templates%20%26%20Examples/Archive%20Log%20Tool%20.workbook) | You are about to modify the retention of the {DataType} table. | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, WorkspaceName, apiVersion, … | 15 | +| [DemoMonitor.workbook](Authoring%2C%20Templates%20%26%20Examples/DemoMonitor.workbook) | Change log | Subscription, Workspace, TimeRange, Help | 10 | +| [dk_demo.workbook](Authoring%2C%20Templates%20%26%20Examples/dk_demo.workbook) | sentinel-UserWorkbook | Workspaces, TimeRange | 2 | +| [Donut-list.workbook](Authoring%2C%20Templates%20%26%20Examples/Donut-list.workbook) | Donut & List Template | TimeRange | 4 | +| [FindmySyntax (1).workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20%281%29.workbook) | select a saved query to run it | Subscription, Workspace, TimeRange | 8 | +| [FindmySyntax v0.2.2.workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20v0.2.2.workbook) | Find and filter for KQL saved Queries, Azure Workbooks and Azure Resource Graph | Subscription, Workspace, TimeRange | 18 | +| [FindmySyntax v0.2.3.workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20v0.2.3.workbook) | Find and filter for KQL saved Queries, Azure Workbooks and Azure Resource Graph | Subscription, Workspace, TimeRange, Help | 20 | +| [FindmySyntax v0.2.4.workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20v0.2.4.workbook) | Find and filter for KQL saved Queries, Azure Workbooks and Azure Resource Graph | Subscription, Workspace, TimeRange, Help | 20 | +| [FindmySyntax v0.2.5b.workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20v0.2.5b.workbook) | Find and filter for KQL saved Queries, Azure Workbooks and Azure Resource Graph | Subscription, Workspace, TimeRange, Help, resourceGroup | 24 | +| [FindmySyntax v0.2.6.workbook](Authoring%2C%20Templates%20%26%20Examples/FindmySyntax%20v0.2.6.workbook) | Find and filter for KQL saved Queries, Azure Workbooks and Azure Resource Graph | Subscription, Workspace, TimeRange, Help, resourceGroup | 26 | +| [Line Chart Callout List.workbook](Authoring%2C%20Templates%20%26%20Examples/Line%20Chart%20Callout%20List.workbook) | Line Chart, Callout, & List Template | TimeRange | 5 | +| [Number List.workbook](Authoring%2C%20Templates%20%26%20Examples/Number%20List.workbook) | Number & List Template | TimeRange | 4 | +| [showMerge.workbook](Authoring%2C%20Templates%20%26%20Examples/showMerge.workbook) | showMerge | — | 5 | +| [showMergewithARGandKQLdemo.workbook](Authoring%2C%20Templates%20%26%20Examples/showMergewithARGandKQLdemo.workbook) | showMergewithARGandKQLdemo | — | 5 | +| [Tabbed Views.workbook](Authoring%2C%20Templates%20%26%20Examples/Tabbed%20Views.workbook) | Tabbed Overview | TimeRange, Message | 11 | +| [Timeline List.workbook](Authoring%2C%20Templates%20%26%20Examples/Timeline%20List.workbook) | Timeline & List Template | TimeRange | 4 | +| [Two Numbers List.workbook](Authoring%2C%20Templates%20%26%20Examples/Two%20Numbers%20List.workbook) | Two Numbers & List Template | TimeRange, Message, Message2nd | 4 | +| [Vertical Overview.workbook](Authoring%2C%20Templates%20%26%20Examples/Vertical%20Overview.workbook) | Vertical Overview | TimeRange | 10 | +| [View Designer Transition Guide.workbook](Authoring%2C%20Templates%20%26%20Examples/View%20Designer%20Transition%20Guide.workbook) | Getting started with creating new views in Workbooks | Time | 18 | +| [withHelp.workbook](Authoring%2C%20Templates%20%26%20Examples/withHelp.workbook) | Help file | Subscription, Workspace, TimeRange, Help | 5 | +| [withHelpandTabs.workbook](Authoring%2C%20Templates%20%26%20Examples/withHelpandTabs.workbook) | Help file | Subscription, Workspace, TimeRange, Help | 7 | +| [withHelpandTabsandGroups.workbook](Authoring%2C%20Templates%20%26%20Examples/withHelpandTabsandGroups.workbook) | Help file | — | 9 | +| [workbooks.workbook](Authoring%2C%20Templates%20%26%20Examples/workbooks.workbook) | workbooks | — | 0 | + +## Compute & Containers + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [Alerts Report (2).workbook](Compute%20%26%20Containers/Alerts%20Report%20%282%29.workbook) | Showing Azure Monitor alerts configured for the selected subscription. | Subscriptions, ResourceGroups, HostPools, TimeRange, poolla, WorkspaceId, … | 8 | +| [Alerts Report.workbook](Compute%20%26%20Containers/Alerts%20Report.workbook) | Showing Azure Monitor alerts configured for the selected subscription. | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 8 | +| [App Failures.workbook](Compute%20%26%20Containers/App%20Failures.workbook) | Application Failures | Apps, TimeRange | 11 | +| [App Performance.workbook](Compute%20%26%20Containers/App%20Performance.workbook) | Application Performance | Apps, TimeRange | 16 | +| [App Service Http Errors.workbook](Compute%20%26%20Containers/App%20Service%20Http%20Errors.workbook) | App Services Http Errors | AppServices, TimeRange | 16 | +| [App Service Key Metrics.workbook](Compute%20%26%20Containers/App%20Service%20Key%20Metrics.workbook) | App Service Metrics | AppServices, TimeRange | 17 | +| [App Usage.workbook](Compute%20%26%20Containers/App%20Usage.workbook) | App Usage | App, Operations, TimeRange, SelectedOperation | 12 | +| [autoscale.workbook](Compute%20%26%20Containers/autoscale.workbook) | No scaling plan found for the host pool. | Subscription, ResourceGroup, HostPool, WVDHosts, WVDHostsId, TimeRange, … | 14 | +| [AVDWorkbookV2.workbook](Compute%20%26%20Containers/AVDWorkbookV2.workbook) | There are session hosts not sending data to the expected Log Analytics workspace. | HostPoolOwner, ShowParameters | 24 | +| [AzureVMwithDiskspace.workbook](Compute%20%26%20Containers/AzureVMwithDiskspace.workbook) | Show Azure Virtual Machines and Disk Space | DefaultWorkspace, ContextFree, Selection | 10 | +| [Billing Usage By Datatable Tab.workbook](Compute%20%26%20Containers/Billing%20Usage%20By%20Datatable%20Tab.workbook) | Billing Usage By Datatable Tab | timeRange, resource, resourceType, clusterId, masterNodeExists | 2 | +| [Billing Usage By Diagnostice Master Node Tab.workbook](Compute%20%26%20Containers/Billing%20Usage%20By%20Diagnostice%20Master%20Node%20Tab.workbook) | Master node logs are not enabled. | timeRange, resource, resourceType, clusterId, masterNodeExists | 3 | +| [Billing Usage By Log Source Tab.workbook](Compute%20%26%20Containers/Billing%20Usage%20By%20Log%20Source%20Tab.workbook) | Billing Usage By Log Source Tab | timeRange, resource, resourceType, clusterId, masterNodeExists | 4 | +| [Billing Usage By Namespace Tab.workbook](Compute%20%26%20Containers/Billing%20Usage%20By%20Namespace%20Tab.workbook) | Billing Usage By Namespace Tab | timeRange, resource, resourceType, clusterId, masterNodeExists | 2 | +| [Billing Usage Divided.workbook](Compute%20%26%20Containers/Billing%20Usage%20Divided.workbook) | Please note that the Container Insights Usage workbook for AKS Engine clusters shows your… | timeRange, resource, resourceType, clusterId, masterNodeExists | 11 | +| [Billing Usage Parameters.workbook](Compute%20%26%20Containers/Billing%20Usage%20Parameters.workbook) | Billing Usage Parameters | timeRange, resource, resourceType, clusterId, masterNodeExists | 1 | +| [CheckAMAConfiguration.workbook](Compute%20%26%20Containers/CheckAMAConfiguration.workbook) | Check diagnostic settings for host pool: {HostPool:label} | Subscription, ResourceGroup, HostPool, WVDHosts, pooldiagcheck, poolla, … | 81 | +| [Client report (2).workbook](Compute%20%26%20Containers/Client%20report%20%282%29.workbook) | Client report (2) | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 11 | +| [Client report.workbook](Compute%20%26%20Containers/Client%20report.workbook) | Client report | Subscriptions, ResourceGroups, HostPools, TimeRange, wvdworkspaces | 8 | +| [Cluster (2).workbook](Compute%20%26%20Containers/Cluster%20%282%29.workbook) | Health Status reflects the Health of each Node for the selected Time range. | timeRange, selectedTab, resource, loganalytics, lastCorrelationId, isHealthy, … | 11 | +| [Cluster (3).workbook](Compute%20%26%20Containers/Cluster%20%283%29.workbook) | Total savings | tabName | 35 | +| [Cluster (4).workbook](Compute%20%26%20Containers/Cluster%20%284%29.workbook) | This cluster is configured with Microsoft Monitoring Agent (MMA), which is being disconti… | timeRange, selectedTab, resource, workspaceId, loganalytics, lastCorrelationId, … | 42 | +| [Cluster (5).workbook](Compute%20%26%20Containers/Cluster%20%285%29.workbook) | The Azure Stack HCI cluster is configured using Microsoft Monitoring Agent and Azure Moni… | timeRange, selectedTab, resource, logAnalyticsWorkSpaceID, logAnalyticsWorkSpaceResource, logAnalyticsWorkSpace, … | 45 | +| [Cluster (6).workbook](Compute%20%26%20Containers/Cluster%20%286%29.workbook) | The Azure Stack HCI cluster is configured using Microsoft Monitoring Agent and Azure Moni… | timeRange, selectedTab, resource, logAnalyticsWorkSpaceID, logAnalyticsWorkSpaceResource, logAnalyticsWorkSpace, … | 48 | +| [Cluster (7).workbook](Compute%20%26%20Containers/Cluster%20%287%29.workbook) | The Azure Local cluster is configured using Microsoft Monitoring Agent and Azure Monitor… | timeRange, selectedTab, resource, workspaceId, loganalytics, lastCorrelationId, … | 45 | +| [Cluster Optimization.workbook](Compute%20%26%20Containers/Cluster%20Optimization.workbook) | Select a container to view liveness probe failures | resource | 37 | +| [Cluster.workbook](Compute%20%26%20Containers/Cluster.workbook) | Cluster Health: | timeRange, subscription, clusters, selectedRg, selectedCluster, Message, … | 19 | +| [ClusterPool.workbook](Compute%20%26%20Containers/ClusterPool.workbook) | ClusterPool | timeRange, nameIdMapping, clusterName | 10 | +| [Connection Details.workbook](Compute%20%26%20Containers/Connection%20Details.workbook) | Connection Details | HostPoolText, HostPool, CorrelationId, TimeRange | 8 | +| [Connection Diagnostics (2).workbook](Compute%20%26%20Containers/Connection%20Diagnostics%20%282%29.workbook) | Please select a {ReportBy} on the left to display further details | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 28 | +| [Connection Diagnostics.workbook](Compute%20%26%20Containers/Connection%20Diagnostics.workbook) | Please select a {ReportBy} on the left to display further details | Subscriptions, ResourceGroups, HostPools, TimeRange | 28 | +| [Connection Performance (2).workbook](Compute%20%26%20Containers/Connection%20Performance%20%282%29.workbook) | Please select a connection to display connection stages. | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 24 | +| [Connection Performance.workbook](Compute%20%26%20Containers/Connection%20Performance.workbook) | RTT values below 100ms are considered healthy and highlighted in green, whereas values ab… | Subscriptions, ResourceGroups, HostPools, TimeRange | 20 | +| [Connection Reliability.workbook](Compute%20%26%20Containers/Connection%20Reliability.workbook) |                          … | Subscriptions, ResourceGroups, HostPools, TimeRange | 13 | +| [CPU heatmap.workbook](Compute%20%26%20Containers/CPU%20heatmap.workbook) | {Message} Virtual machines | Subscription, VirtualMachines, TimeRange, Message | 6 | +| [Deployments and HPAs.workbook](Compute%20%26%20Containers/Deployments%20and%20HPAs.workbook) | Insights data is not available with custom data collection. | resource | 17 | +| [Failure Insights.workbook](Compute%20%26%20Containers/Failure%20Insights.workbook) | Application Failures Insights | Apps, TimeRange, Operation | 16 | +| [Flink.workbook](Compute%20%26%20Containers/Flink.workbook) | Flink | timeRange, clusterName, nameIdMapping | 43 | +| [Hadoop.workbook](Compute%20%26%20Containers/Hadoop.workbook) | No Hive Metrics are in Log Analytics for this cluster. | Cluster, TimeRange, HiveMetricsPresent, Usage | 85 | +| [HBase.workbook](Compute%20%26%20Containers/HBase.workbook) | Metrics and Logs are not flowing to the Hive tables. | Cluster, TimeRange | 214 | +| [HDInsightAtScale.workbook](Compute%20%26%20Containers/HDInsightAtScale.workbook) | No HBase logs or metrics were detected in Log Analytics workspaces for the clusters you s… | Subscription, Clusters, TimeRange, Message | 193 | +| [Host Diagnostics.workbook](Compute%20%26%20Containers/Host%20Diagnostics.workbook) | There are no AVD host agents reporting errors or warnings to the event log in the selecte… | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 44 | +| [Host Performance.workbook](Compute%20%26%20Containers/Host%20Performance.workbook) | Input delay is characterized for median and p95th columns with green below or equal to 10… | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 11 | +| [Host Pool Overview.workbook](Compute%20%26%20Containers/Host%20Pool%20Overview.workbook) | Please select a host to display current sessions here. | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 14 | +| [Insights.workbook](Compute%20%26%20Containers/Insights.workbook) | State of all the virtual machines in selected clusters | timeRange, subscription, clusters, selectedRg, selectedCluster, Message, … | 30 | +| [InteractiveHive.workbook](Compute%20%26%20Containers/InteractiveHive.workbook) | No Hive Metrics found in Log Analytics. | Cluster, TimeRange, usage, HiveMetricsPresent | 124 | +| [Kafka.workbook](Compute%20%26%20Containers/Kafka.workbook) | Zookeeper Metrics | Cluster | 103 | +| [Key Metrics (2).workbook](Compute%20%26%20Containers/Key%20Metrics%20%282%29.workbook) | {Message} Virtual machines | Subscription, VirtualMachines, TimeRange, Message | 16 | +| [Key Metrics (3).workbook](Compute%20%26%20Containers/Key%20Metrics%20%283%29.workbook) | Virtual Machines Metrics | VirtualMachines, TimeRange | 19 | +| [Key Metrics.workbook](Compute%20%26%20Containers/Key%20Metrics.workbook) | Virtual Machines (Classic) Metrics | VirtualMachines, TimeRange | 19 | +| [LLAP.workbook](Compute%20%26%20Containers/LLAP.workbook) | LLAP | timeRange, clusterName | 14 | +| [Multi Cluster Controllers.workbook](Compute%20%26%20Containers/Multi%20Cluster%20Controllers.workbook) | Multi Cluster Controllers | timeRange, Subscription, selectedCluster, selectedAppNamespace, ResourceType | 7 | +| [Multi Cluster Overview.workbook](Compute%20%26%20Containers/Multi%20Cluster%20Overview.workbook) | Multi cluster dashboard | timeRange, Subscription, ResourceType, selectedCluster, ResourceName | 27 | +| [Multi Cluster Performance.workbook](Compute%20%26%20Containers/Multi%20Cluster%20Performance.workbook) | Multi Cluster Performance | timeRange, Subscription, ResourceType, selectedCluster, hiveSelectedCluster, hiveSelectedNode | 7 | +| [NoData.workbook](Compute%20%26%20Containers/NoData.workbook) | Azure Monitor is not configured for the selected AVD hostpool. | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 9 | +| [Node Disk Capacity.workbook](Compute%20%26%20Containers/Node%20Disk%20Capacity.workbook) | Insights data is not available with custom data collection. | resource | 22 | +| [Node Disk IO.workbook](Compute%20%26%20Containers/Node%20Disk%20IO.workbook) | Insights data is not available with custom data collection. | resource | 33 | +| [Node GPU.workbook](Compute%20%26%20Containers/Node%20GPU.workbook) | Insights data is not available with custom data collection. | resource | 19 | +| [Node Kubelet.workbook](Compute%20%26%20Containers/Node%20Kubelet.workbook) | Insights data is not available with custom data collection. | resource | 26 | +| [Node Network.workbook](Compute%20%26%20Containers/Node%20Network.workbook) | Insights data is not available with custom data collection. | resource | 33 | +| [NPM Configuration.workbook](Compute%20%26%20Containers/NPM%20Configuration.workbook) | Insights data is not available with custom data collection. | resource | 24 | +| [OSM Destination Grid.workbook](Compute%20%26%20Containers/OSM%20Destination%20Grid.workbook) | Select a row below to start. | Time_Range, filterEnvoyInternals, envoyWhereClause, resource, resourceType, Namespace, … | 17 | +| [OSM Destination Metrics.workbook](Compute%20%26%20Containers/OSM%20Destination%20Metrics.workbook) | Source: {SourceService} | resource, resourceType, clusterId, clusterIdWhereClause, TimeRange, FilterInternals, … | 11 | +| [Overview (2).workbook](Compute%20%26%20Containers/Overview%20%282%29.workbook) | No new Severity {AlertLevel} alerts in {TimeRange:label} | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 31 | +| [Overview.workbook](Compute%20%26%20Containers/Overview.workbook) | No new Severity {AlertLevel} alerts in {TimeRange:label} | Subscriptions, ResourceGroups, HostPools, TimeRange | 31 | +| [Performance Analysis (Perf).workbook](Compute%20%26%20Containers/Performance%20Analysis%20%28Perf%29.workbook) | Top 10 Machines | Resource | 29 | +| [Performance Analysis for a Group of VMs (Azure Preview).workbook](Compute%20%26%20Containers/Performance%20Analysis%20for%20a%20Group%20of%20VMs%20%28Azure%20Preview%29.workbook) | Performance Analysis | DefaultSubscription, DefaultResourceGroup, SelectedResourceGroup, DefaultWorkspace, Subscription, ResourceGroups, … | 24 | +| [Performance Analysis for a Group of VMs (Perf).workbook](Compute%20%26%20Containers/Performance%20Analysis%20for%20a%20Group%20of%20VMs%20%28Perf%29.workbook) | Performance Analysis | DefaultWorkspace, ContextFree, Selection | 31 | +| [Performance Analysis for a Group of VMs.workbook](Compute%20%26%20Containers/Performance%20Analysis%20for%20a%20Group%20of%20VMs.workbook) | Performance Analysis | DefaultWorkspace, ContextFree, Selection | 26 | +| [Performance Analysis for a Single VM (Perf).workbook](Compute%20%26%20Containers/Performance%20Analysis%20for%20a%20Single%20VM%20%28Perf%29.workbook) | Performance Analysis | Computer, TimeRange, PerfLogs, isOnboarded | 33 | +| [Performance Analysis for a Single VM.workbook](Compute%20%26%20Containers/Performance%20Analysis%20for%20a%20Single%20VM.workbook) | Performance Analysis | Computer, TimeRange, ResourceType, InsightsMetricsLogs, isOnboarded | 33 | +| [Performance Analysis.workbook](Compute%20%26%20Containers/Performance%20Analysis.workbook) | Performance Analysis | DefaultResource, Selection | 25 | +| [Performance Counters (2).workbook](Compute%20%26%20Containers/Performance%20Counters%20%282%29.workbook) | ⚠ No performance counters were detected in the selected workspace for the specified time… | Blank, DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, … | 27 | +| [Performance Counters (Azure Preview).workbook](Compute%20%26%20Containers/Performance%20Counters%20%28Azure%20Preview%29.workbook) | {Counter1:label}{TrendAggregator1:label} {TrendAggregatorOrder1} {Unit:label} | DefaultResource, ContextFree, Selection, Subscriptions, ResourceGroup, Resources, … | 38 | +| [Performance Counters (Perf).workbook](Compute%20%26%20Containers/Performance%20Counters%20%28Perf%29.workbook) | ⚠ No performance counters were detected in the selected workspace for the specified time… | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 27 | +| [Performance Counters.workbook](Compute%20%26%20Containers/Performance%20Counters.workbook) | Application Performance Counters | Apps, TimeRange | 14 | +| [Performance Insights.workbook](Compute%20%26%20Containers/Performance%20Insights.workbook) | Application Performance Insights | Apps, TimeRange, Operation, Columns | 18 | +| [Performance Metrics.workbook](Compute%20%26%20Containers/Performance%20Metrics.workbook) | Performance Metrics | timeRange, subscription, selectedRg, selectedCluster | 74 | +| [Persistent Volume Details.workbook](Compute%20%26%20Containers/Persistent%20Volume%20Details.workbook) | Insights data is not available with custom data collection. | resource | 11 | +| [Presto.workbook](Compute%20%26%20Containers/Presto.workbook) | Presto | timeRange, clustername | 14 | +| [Resource Monitor.workbook](Compute%20%26%20Containers/Resource%20Monitor.workbook) | CPU | Workspace, TimeRange, ComputerNameContains, Computers, ComputerFilter | 18 | +| [SCOM detailed insights.workbook](Compute%20%26%20Containers/SCOM%20detailed%20insights.workbook) | SCOM detailed insights | InstanceName, LAWorkspace, ResourceId, timeRange, ComputerName | 4 | +| [SCOM insights.workbook](Compute%20%26%20Containers/SCOM%20insights.workbook) | 💡 Click on the "% CPU Average" value of a resource to view detailed performance counters. | InstanceName, LAWorkspace, timeRange | 13 | +| [SCOM monitored VMs detailed health.workbook](Compute%20%26%20Containers/SCOM%20monitored%20VMs%20detailed%20health.workbook) | SCOM monitored VMs detailed health | ResourceId, ComputerName | 3 | +| [Server Availability.workbook](Compute%20%26%20Containers/Server%20Availability.workbook) | Server Availability | TimeRange, Subscription, Workspace, Servers | 2 | +| [Single cluster Performance Metrics.workbook](Compute%20%26%20Containers/Single%20cluster%20Performance%20Metrics.workbook) | Single cluster Performance Metrics | timeRange, resource | 74 | +| [Spark.workbook](Compute%20%26%20Containers/Spark.workbook) | These graphs require Spark Application Logs to be present. | Cluster, TimeRange, usage | 114 | +| [SQL Assessment.workbook](Compute%20%26%20Containers/SQL%20Assessment.workbook) | SQL best practices assessment results | VmResourceId, instanceName, typeSystem, typeAdmins, typeDevs, AssessmentId, … | 43 | +| [Storm.workbook](Compute%20%26%20Containers/Storm.workbook) | No Logs present in your workspace. | Cluster, TimeRange, usage | 52 | +| [Subnet IP Usage.workbook](Compute%20%26%20Containers/Subnet%20IP%20Usage.workbook) | Node selection required. | resource | 37 | +| [Syslog.workbook](Compute%20%26%20Containers/Syslog.workbook) | Syslog | resource, resourceType, timeRange, HostName, Facility, SeverityLevel | 10 | +| [Template Versioning Footer.workbook](Compute%20%26%20Containers/Template%20Versioning%20Footer.workbook) | ---- Azure Monitor for Azure Virtual Desktop v.{TemplateVersion} | TemplateVersion | 2 | +| [Trino.workbook](Compute%20%26%20Containers/Trino.workbook) | Trino | timeRange, clusterName | 14 | +| [User report (2).workbook](Compute%20%26%20Containers/User%20report%20%282%29.workbook) | Enter a full or partial user name above and select a match from the dropdown to see a rep… | Subscription, ResourceGroup, HostPool, WVDHosts, TimeRange, poolla, … | 28 | +| [User Report.workbook](Compute%20%26%20Containers/User%20Report.workbook) | Enter a full or partial user name above and select a match from the dropdown to see a rep… | Subscriptions, ResourceGroups, HostPools, TimeRange, poolla, WorkspaceId, … | 28 | +| [Utilization Report (2).workbook](Compute%20%26%20Containers/Utilization%20Report%20%282%29.workbook) | No data was found. | Subscription, ResourceGroup, HostPool, WVDHosts, WVDHostsId, TimeRange, … | 28 | +| [Utilization Report.workbook](Compute%20%26%20Containers/Utilization%20Report.workbook) | Utilization Report | Subscriptions, ResourceGroups, HostPools, TimeRange | 24 | +| [Virtual machine details.workbook](Compute%20%26%20Containers/Virtual%20machine%20details.workbook) | Virtual machine details | TimeRange, SelectedVM | 4 | +| [Virtual Machine overview.workbook](Compute%20%26%20Containers/Virtual%20Machine%20overview.workbook) | Virtual Machine overview | TimeRange, SelectedVM | 5 | +| [Virtual Machine Performance.workbook](Compute%20%26%20Containers/Virtual%20Machine%20Performance.workbook) | Virtual Machine Performance | TimeRange, Workspace, VirtualMachines, Counter, Metrics, computer | 8 | +| [Workload Details Divided.workbook](Compute%20%26%20Containers/Workload%20Details%20Divided.workbook) | Insights data is not available with custom data collection. | resource | 19 | +| [Workload Details K8s Events Tab.workbook](Compute%20%26%20Containers/Workload%20Details%20K8s%20Events%20Tab.workbook) | Workload Details K8s Events Tab | timeRange, resource, resourceType, clusterId, clusterIdWhereClause, workloadType, … | 5 | +| [Workload Details Persistent Volumes Tab.workbook](Compute%20%26%20Containers/Workload%20Details%20Persistent%20Volumes%20Tab.workbook) | Workload Details Persistent Volumes Tab | timeRange, resource, resourceType, clusterId, clusterIdWhereClause, workloadType, … | 5 | +| [Workload Details Pod-Container Status Tab.workbook](Compute%20%26%20Containers/Workload%20Details%20Pod-Container%20Status%20Tab.workbook) | Workload Details Pod-Container Status Tab | timeRange, resource, resourceType, clusterId, clusterIdWhereClause, workloadType, … | 6 | +| [WVDWorkbookV1.workbook](Compute%20%26%20Containers/WVDWorkbookV1.workbook) | The Log Analytics Agent has been deprecated. | HostPoolOwner, ShowParameters | 24 | +| [WVDWorkbookV2.workbook](Compute%20%26%20Containers/WVDWorkbookV2.workbook) | WVDWorkbookV2 | Subscriptions, ResourceGroups, HostPools, TimeRange, wvdworkspaces | 12 | + +## Databases & Data + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [activity (2).workbook](Databases%20%26%20Data/activity%20%282%29.workbook) | The grid shows a snapshot of active user sessions in all databases in this elastic pool a… | activitySampleType | 20 | +| [activity (3).workbook](Databases%20%26%20Data/activity%20%283%29.workbook) | The grid shows a snapshot of active user sessions at a point in time. | activitySampleType | 20 | +| [activity (4).workbook](Databases%20%26%20Data/activity%20%284%29.workbook) | The grid shows a snapshot of active user sessions at a point in time. | activitySampleType | 20 | +| [activity.workbook](Databases%20%26%20Data/activity.workbook) | The grid shows a snapshot of active user sessions in this database at a point in time. | activitySampleType | 20 | +| [Auditing.workbook](Databases%20%26%20Data/Auditing.workbook) | This template requires Activity logs to be enabled. | Resource, TimeRange | 17 | +| [Autovacuum Blockers.workbook](Databases%20%26%20Data/Autovacuum%20Blockers.workbook) | Troubleshoot autovacuum blockers and wraparound risk | Resource, TimeRange, MIN_TIME_WINDOW_SEC, THRESHOLD_AV, THRESHOLD_REPLICATION, THRESHOLD_WRAPAROUND, … | 69 | +| [Autovacuum Monitoring.workbook](Databases%20%26%20Data/Autovacuum%20Monitoring.workbook) | Autovacuum monitoring | MIN_TIME_WINDOW_SEC, TimeRange, Resource, GlobalEndTime, GlobalStartTime, WRAPAROUND_LOOK_BACK_DAYS, … | 101 | +| [Azure Data Factory Analytics.workbook](Databases%20%26%20Data/Azure%20Data%20Factory%20Analytics.workbook) | Azure Data Factory Analytics | TimeRange | 34 | +| [AzureDataFactoryv2.workbook](Databases%20%26%20Data/AzureDataFactoryv2.workbook) | Azure Data Factory Analytics | TimeRange | 32 | +| [backup (2).workbook](Databases%20%26%20Data/backup%20%282%29.workbook) | backup (2) | — | 5 | +| [backup (3).workbook](Databases%20%26%20Data/backup%20%283%29.workbook) | backup (3) | includeSystemDatabaseBackups | 7 | +| [backup.workbook](Databases%20%26%20Data/backup.workbook) | backup | — | 4 | +| [Cassandra Insights.workbook](Databases%20%26%20Data/Cassandra%20Insights.workbook) | For more information on status codes visit: https://aka.ms/sql-status-codes | Resources, TimeRange, EnabledApiTypes, ApiDatabases, Keyspace | 38 | +| [Cassandra MI Insights.workbook](Databases%20%26%20Data/Cassandra%20MI%20Insights.workbook) | Cassandra MI Insights | Resources, TimeRange, Datacenter | 33 | +| [connectivity (2).workbook](Databases%20%26%20Data/connectivity%20%282%29.workbook) | Each connectivity probe opens a new connection and executes a simple read query. | connectivitySampleType | 9 | +| [connectivity (3).workbook](Databases%20%26%20Data/connectivity%20%283%29.workbook) | Each connectivity probe opens a new connection and executes a simple read query. | connectivitySampleType | 9 | +| [connectivity (4).workbook](Databases%20%26%20Data/connectivity%20%284%29.workbook) | Each connectivity probe opens a new connection and executes a simple read query. | connectivitySampleType | 9 | +| [connectivity.workbook](Databases%20%26%20Data/connectivity.workbook) | Each connectivity probe opens a new connection and executes a simple read query. | connectivitySampleType | 9 | +| [database storage io.workbook](Databases%20%26%20Data/database%20storage%20io.workbook) | database storage io | storageIoWorkloadType | 11 | +| [database.workbook](Databases%20%26%20Data/database.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 99 | +| [databases (2).workbook](Databases%20%26%20Data/databases%20%282%29.workbook) | Data is collected from sys.databases, sys.databasescopedconfigurations, sys.dmossysinfo,… | databaseSampleType | 65 | +| [databases (3).workbook](Databases%20%26%20Data/databases%20%283%29.workbook) | Data is collected from sys.databases, sys.databasescopedconfigurations, sys.dmossysinfo,… | databaseSampleType | 48 | +| [databases.workbook](Databases%20%26%20Data/databases.workbook) | On each heatmap, a hexagon represents a database in this elastic pool Heatmaps show top r… | — | 13 | +| [elastic pool storage io.workbook](Databases%20%26%20Data/elastic%20pool%20storage%20io.workbook) | elastic pool storage io | storageIoWorkloadType | 11 | +| [elastic pool.workbook](Databases%20%26%20Data/elastic%20pool.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 72 | +| [Enhanced Metrics (2).workbook](Databases%20%26%20Data/Enhanced%20Metrics%20%282%29.workbook) | To enable Enhanced metrics, please turn ON the server parameter metrics.collectordatabase… | Resource, TimeRange | 25 | +| [Enhanced Metrics.workbook](Databases%20%26%20Data/Enhanced%20Metrics.workbook) | Enhanced Metrics | Time, Host | 15 | +| [estate (2).workbook](Databases%20%26%20Data/estate%20%282%29.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 26 | +| [estate (3).workbook](Databases%20%26%20Data/estate%20%283%29.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 25 | +| [estate.workbook](Databases%20%26%20Data/estate.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 44 | +| [georeplicas.workbook](Databases%20%26%20Data/georeplicas.workbook) | \|Metric\|Description\| \|:-\|:-\| \|Log send rate\|The rate at which the primary replica… | georeplicationSampleType | 15 | +| [High CPU Usage.workbook](Databases%20%26%20Data/High%20CPU%20Usage.workbook) | Troubleshoot high CPU utilization | Resource, TimeRange, MIN_TIME_WINDOW_SEC, HIGH_CONNECTION_COUNT, LONG_RUNNING_QUERY_SEC_DURATION_THRESHOLD, WINDOW_SIZE_FOR_QUERY_TIME_CAPTURE, … | 161 | +| [High IOPS Usage.workbook](Databases%20%26%20Data/High%20IOPS%20Usage.workbook) | Troubleshoot high IOPS utilization | Resource, TimeRange, MIN_TIME_WINDOW_SEC, QueryStoreTable, SessionsTable, PGServerLogsTable, … | 81 | +| [High Memory Usage.workbook](Databases%20%26%20Data/High%20Memory%20Usage.workbook) | Troubleshoot high memory utilization | Resource, TimeRange, MIN_TIME_WINDOW_SEC, READ_WORKLOAD_SPIKE_TUP_RETURNED_PCT, WINDOW_SIZE_FOR_QUERY_TIME_CAPTURE, SHORT_CONNECTION_DURATION, … | 80 | +| [High Temporary Files.workbook](Databases%20%26%20Data/High%20Temporary%20Files.workbook) | Troubleshoot high temporary file utilization | TimeRange, Resource, MIN_TIME_WINDOW_SEC, READ_WORKLOAD_SPIKE_TUP_RETURNED_PCT, WINDOW_SIZE_FOR_QUERY_TIME_CAPTURE, MIN_TIME_WINDOW_SEC, … | 49 | +| [Highest RU consumption.workbook](Databases%20%26%20Data/Highest%20RU%20consumption.workbook) | Step 1. Let's understand what Highest RU Consuming Shard means in Cosmos DB | Resources, TimeRange, EnabledApiTypes, ApiDatabases, Database, ResourceId, … | 28 | +| [indexes.workbook](Databases%20%26%20Data/indexes.workbook) | \|Index warnings\| \|:--\| {indexwarnings} | indexType, indexOperations, maxPartitions | 10 | +| [ingestion stats.workbook](Databases%20%26%20Data/ingestion%20stats.workbook) | ingestion stats | adxClusterUri, adxDatabase, timeRange, targetType | 2 | +| [Insights.workbook](Databases%20%26%20Data/Insights.workbook) | {Message} Azure Data Explorer Cluster | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 10 | +| [instance (2).workbook](Databases%20%26%20Data/instance%20%282%29.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 75 | +| [instance.workbook](Databases%20%26%20Data/instance.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, linkAdxClusterUri, linkAdxDatabase | 75 | +| [Log Analytics.workbook](Databases%20%26%20Data/Log%20Analytics.workbook) | Enable Log Analytics for per second level troubleshooting | Resources, TimeRange, EnabledApiTypes, ApiDatabases, Database, ResourceId, … | 49 | +| [Metrics Overview.workbook](Databases%20%26%20Data/Metrics%20Overview.workbook) | Storage Metrics | TimeRange, Resource | 18 | +| [Mongo Insights.workbook](Databases%20%26%20Data/Mongo%20Insights.workbook) | For additional information on status codes visit: https://aka.ms/mongo-db-error-codes | Resources, TimeRange, EnabledApiTypes, ApiDatabases, Database | 38 | +| [Optimizing Total Provisioned Throughput.workbook](Databases%20%26%20Data/Optimizing%20Total%20Provisioned%20Throughput.workbook) | Billing Overview | — | 33 | +| [Overview (2).workbook](Databases%20%26%20Data/Overview%20%282%29.workbook) | Note: This feature is only available for clusters tier M40 and up. | Resources, TimeRange | 24 | +| [Overview (3).workbook](Databases%20%26%20Data/Overview%20%283%29.workbook) | Start editing the Overview section here | Subscription, TimeRange, ResourceName, ResourceImageUrl, Hidden, Resources | 19 | +| [Overview (4).workbook](Databases%20%26%20Data/Overview%20%284%29.workbook) | Connection Metric | Resource, TimeRange | 15 | +| [Overview (5).workbook](Databases%20%26%20Data/Overview%20%285%29.workbook) | Server Details | Resource, TimeRange | 17 | +| [Overview.workbook](Databases%20%26%20Data/Overview.workbook) | Start editing the Overview section here | TimeRange, Fleet, Fleetspaces, Resources | 24 | +| [Performance Troubleshooting.workbook](Databases%20%26%20Data/Performance%20Troubleshooting.workbook) | Performance Troubleshooting | — | 7 | +| [properties (2).workbook](Databases%20%26%20Data/properties%20%282%29.workbook) | properties (2) | propertySampleType | 9 | +| [properties (3).workbook](Databases%20%26%20Data/properties%20%283%29.workbook) | Data is collected from sys.dminstanceresourcegovernance, sys.dmossysinfo, sys.configurati… | propertySampleType | 13 | +| [properties (4).workbook](Databases%20%26%20Data/properties%20%284%29.workbook) | Data is collected from sys.dmossysinfo, sys.dmossysmemory, sys.configurations, sys.dmosho… | propertySampleType | 14 | +| [properties.workbook](Databases%20%26%20Data/properties.workbook) | Data is collected from sys.databases, sys.databasescopedconfigurations, sys.dmossysinfo,… | propertySampleType | 12 | +| [Query Performance Insight.workbook](Databases%20%26%20Data/Query%20Performance%20Insight.workbook) | Query Load | Resource, TimeRange | 16 | +| [Query Performance Insights.workbook](Databases%20%26%20Data/Query%20Performance%20Insights.workbook) | Query store is currently disabled | TimeRange, Resource, MIN_TIME_WINDOW_SEC, QueryStoreTable, QueryStoreWaitSampling, SessionsTable | 108 | +| [query store intervals (2).workbook](Databases%20%26%20Data/query%20store%20intervals%20%282%29.workbook) | query store intervals (2) | qdsQueryHash, qdsQueryText, qdsStartTime, qdsEndTime, adxClusterUri, adxDatabase, … | 2 | +| [query store intervals (3).workbook](Databases%20%26%20Data/query%20store%20intervals%20%283%29.workbook) | query store intervals (3) | qdsQueryHash, qdsQueryText, qdsStartTime, qdsEndTime, adxClusterUri, adxDatabase, … | 2 | +| [query store intervals (4).workbook](Databases%20%26%20Data/query%20store%20intervals%20%284%29.workbook) | query store intervals (4) | adxClusterUri, adxDatabase, managedInstanceName, qdsStartTime, qdsEndTime, qdsCollectionReplicaType | 2 | +| [query store intervals (5).workbook](Databases%20%26%20Data/query%20store%20intervals%20%285%29.workbook) | query store intervals (5) | qdsQueryHash, qdsQueryText, qdsStartTime, qdsEndTime, adxClusterUri, adxDatabase, … | 2 | +| [query store intervals (6).workbook](Databases%20%26%20Data/query%20store%20intervals%20%286%29.workbook) | query store intervals (6) | adxClusterUri, adxDatabase, serverName, machineName, qdsStartTime, qdsEndTime | 2 | +| [query store intervals.workbook](Databases%20%26%20Data/query%20store%20intervals.workbook) | query store intervals | adxClusterUri, adxDatabase, serverName, databaseName, qdsCollectionReplicaType, qdsStartTime, … | 2 | +| [replicas.workbook](Databases%20%26%20Data/replicas.workbook) | replicas | replicasSampleType | 22 | +| [Resource Insights.workbook](Databases%20%26%20Data/Resource%20Insights.workbook) | Resource Insights | Resources, EnabledApiTypes, ApiDatabases | 5 | +| [ResourceCacheDetails.workbook](Databases%20%26%20Data/ResourceCacheDetails.workbook) |  Advisor cache recommendations Advisor recommendations are based on the last 30 days… | Resource, TimeRange | 22 | +| [ResourceClusterBoundaries.workbook](Databases%20%26%20Data/ResourceClusterBoundaries.workbook) | Loading | Resource, TimeRange | 58 | +| [ResourceIngestionDetails.workbook](Databases%20%26%20Data/ResourceIngestionDetails.workbook) | Monitor the batching ingestion stages | Resource, TimeRange | 163 | +| [ResourceInsights.workbook](Databases%20%26%20Data/ResourceInsights.workbook) | --- | Resource, TimeRange | 108 | +| [ResourceInsightsHelpContent.workbook](Databases%20%26%20Data/ResourceInsightsHelpContent.workbook) | Metric Definitions | — | 1 | +| [ResourceMaterializedViewDetails.workbook](Databases%20%26%20Data/ResourceMaterializedViewDetails.workbook) | Materialized views health per database Click on a row to drill down | Resource, TimeRange, EnabledLogs | 18 | +| [ResourceServerQueryFailureAnalysis.workbook](Databases%20%26%20Data/ResourceServerQueryFailureAnalysis.workbook) | Guide for using this tab | Resource | 46 | +| [ResourceTableDetails.workbook](Databases%20%26%20Data/ResourceTableDetails.workbook) |  Cluster's total extents count | Resource, TimeRange | 29 | +| [ResourceVnetDetails.workbook](Databases%20%26%20Data/ResourceVnetDetails.workbook) | Virtual network diagnostics Use the virtual network diagnostics page to find issues with… | Resource, TimeRange | 11 | +| [sessions (2).workbook](Databases%20%26%20Data/sessions%20%282%29.workbook) | \|Metric\|Description\| \|:-\|:-\| \|User sessions\|The number of user sessions charted o… | loginName, hostName, programName, databaseName, excludeWatcherSessions, loginNameFilter, … | 12 | +| [sessions (3).workbook](Databases%20%26%20Data/sessions%20%283%29.workbook) | \|Metric\|Description\| \|:-\|:-\| \|User sessions\|The number of user sessions charted o… | loginName, hostName, programName, databaseName, excludeWatcherSessions, loginNameFilter, … | 12 | +| [sessions.workbook](Databases%20%26%20Data/sessions.workbook) | \|Metric\|Description\| \|:-\|:-\| \|User sessions\|The number of user sessions charted o… | loginName, hostName, programName, excludeWatcherSessions, loginNameFilter, hostNameFilter, … | 12 | +| [SparkInfrastructure.workbook](Databases%20%26%20Data/SparkInfrastructure.workbook) | Missing metrics table | DefaultSubscription_Internal, Subscription, DefaultWorkspace, Workspace, TimeRange, SparkMetrics_CLMissing, … | 10 | +| [SparkStructuredStreaming.workbook](Databases%20%26%20Data/SparkStructuredStreaming.workbook) | Missing Streaming Stats | DefaultSubscription_Internal, Subscription, DefaultWorkspace, Workspace, TimeRange, SparkMetrics_CLMissing, … | 10 | +| [SQL Assessment.workbook](Databases%20%26%20Data/SQL%20Assessment.workbook) | SQL best practices assessment results | VmResourceId, typeSystem, typeAdmins, typeDevs, AssessmentId, showDashboard, … | 42 | +| [SQL Database Metrics.workbook](Databases%20%26%20Data/SQL%20Database%20Metrics.workbook) | SQL Database Metrics | Database, TimeRange | 32 | +| [SQL Database Resource Limits.workbook](Databases%20%26%20Data/SQL%20Database%20Resource%20Limits.workbook) | SQL Database Resource Limits | Database, TimeRange | 20 | +| [SQL Insights.workbook](Databases%20%26%20Data/SQL%20Insights.workbook) | 💡 Need help troubleshooting? | Resources, TimeRange, EnabledApiTypes, ApiDatabases, Database | 64 | +| [sql text.workbook](Databases%20%26%20Data/sql%20text.workbook) | sql text | sqlText | 1 | +| [sqlagent (2).workbook](Databases%20%26%20Data/sqlagent%20%282%29.workbook) | sqlagent (2) | sqlagentstateSampleType | 13 | +| [sqlagent.workbook](Databases%20%26%20Data/sqlagent.workbook) | sqlagent | sqlagentstateSampleType | 13 | +| [storage (2).workbook](Databases%20%26%20Data/storage%20%282%29.workbook) | Metrics on these charts describe storage space consumption in data and transaction log fi… | — | 15 | +| [storage (3).workbook](Databases%20%26%20Data/storage%20%283%29.workbook) | Metrics on these charts describe storage IO statistics including IOPS, throughput, and la… | — | 10 | +| [storage (4).workbook](Databases%20%26%20Data/storage%20%284%29.workbook) | Metrics on these charts describe storage IO statistics including IOPS, throughput, and la… | — | 10 | +| [storage io (2).workbook](Databases%20%26%20Data/storage%20io%20%282%29.workbook) | storage io (2) | ioMetric, ioDirection, ioFileType, ioDatabaseType | 4 | +| [storage io.workbook](Databases%20%26%20Data/storage%20io.workbook) | storage io | ioMetric, ioDirection, ioFileType, ioDatabaseType | 4 | +| [storage.workbook](Databases%20%26%20Data/storage.workbook) | Storage consumption metrics are expressed as percentages toward the maximum size. | — | 18 | +| [tables.workbook](Databases%20%26%20Data/tables.workbook) | tables | tableSampleType | 12 | +| [top databases (2).workbook](Databases%20%26%20Data/top%20databases%20%282%29.workbook) | top databases (2) | qdsMetric, qdsExecutionType, qdsReplicaGroup, qdsDatabaseNameFilter, qdsQueryHash, qdsQueryText, … | 2 | +| [top databases (3).workbook](Databases%20%26%20Data/top%20databases%20%283%29.workbook) | top databases (3) | adxClusterUri, adxDatabase, managedInstanceName, qdsStartTime, qdsEndTime, qdsMetric, … | 2 | +| [top databases (4).workbook](Databases%20%26%20Data/top%20databases%20%284%29.workbook) | top databases (4) | qdsMetric, qdsExecutionType, qdsDatabaseNameFilter, qdsQueryHash, qdsQueryText, qdsStartTime, … | 2 | +| [top databases (5).workbook](Databases%20%26%20Data/top%20databases%20%285%29.workbook) | top databases (5) | adxClusterUri, adxDatabase, machineName, serverName, qdsStartTime, qdsEndTime, … | 2 | +| [top databases.workbook](Databases%20%26%20Data/top%20databases.workbook) | top databases | qdsMetric, qdsExecutionType, qdsReplicaGroup, qdsDatabaseNameFilter, qdsQueryHash, qdsQueryText, … | 2 | +| [top queries (2).workbook](Databases%20%26%20Data/top%20queries%20%282%29.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsMissingDataWarningText | 33 | +| [top queries (3).workbook](Databases%20%26%20Data/top%20queries%20%283%29.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsMissingDataWarningText | 33 | +| [top queries (4).workbook](Databases%20%26%20Data/top%20queries%20%284%29.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsCollectionReplicaType, qdsMissingDataWarningText | 38 | +| [top queries (5).workbook](Databases%20%26%20Data/top%20queries%20%285%29.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsMissingDataWarningText | 33 | +| [top queries (6).workbook](Databases%20%26%20Data/top%20queries%20%286%29.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsMissingDataWarningText | 37 | +| [top queries.workbook](Databases%20%26%20Data/top%20queries.workbook) | A top query is defined as a query consuming the most resources in a time interval. | qdsStartTime, qdsEndTime, qdsCollectionReplicaType, qdsMissingDataWarningText | 38 | +| [watcher.workbook](Databases%20%26%20Data/watcher.workbook) | Kusto query URI: {watcherAdxClusterUri} Kusto database: {watcherAdxDatabase} | watcherResourceId, showWatcherSelector | 23 | + +## Endpoint & Intune + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [DeviceComplianceTrends (2).workbook](Endpoint%20%26%20Intune/DeviceComplianceTrends%20%282%29.workbook) | Device compliance | ComplianceState, OS, Schema, Environment | 3 | +| [DeviceComplianceTrends.workbook](Endpoint%20%26%20Intune/DeviceComplianceTrends.workbook) | Device compliance | ComplianceState, OS, GraphVersion | 3 | +| [Intune-EndpointMgrDeviceIDReference.workbook](Endpoint%20%26%20Intune/Intune-EndpointMgrDeviceIDReference.workbook) | New workbook | — | 3 | +| [IntuneAuditActivity (2).workbook](Endpoint%20%26%20Intune/IntuneAuditActivity%20%282%29.workbook) | Intune Audit Activity | TimeRange | 14 | +| [IntuneAuditActivity.workbook](Endpoint%20%26%20Intune/IntuneAuditActivity.workbook) | Intune Audit Activity | TimeRange | 14 | +| [IntuneCompliance.workbook](Endpoint%20%26%20Intune/IntuneCompliance.workbook) | Intune Compliance Activity | TimeRange | 9 | +| [IntuneComplianceActivity.workbook](Endpoint%20%26%20Intune/IntuneComplianceActivity.workbook) | Intune Compliance Activity | TimeRange | 9 | +| [IntuneDevices.workbook](Endpoint%20%26%20Intune/IntuneDevices.workbook) | Intune Devices Activity | TimeRange | 11 | +| [IntuneEnrollment.workbook](Endpoint%20%26%20Intune/IntuneEnrollment.workbook) | Intune Enrollment Activity | TimeRange | 16 | +| [IntuneEnrollmentActivity.workbook](Endpoint%20%26%20Intune/IntuneEnrollmentActivity.workbook) | Intune Enrollment Activity | TimeRange | 16 | +| [MicrosoftDefenderForEndPoint v1.1.workbook](Endpoint%20%26%20Intune/MicrosoftDefenderForEndPoint%20v1.1.workbook) | Microsoft Defender for Endpoint (Preview) | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, Help | 30 | + +## Identity & Access + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [AAD cloud sync details.workbook](Identity%20%26%20Access/AAD%20cloud%20sync%20details.workbook) | Cloud sync provisioning log details | Status, TimeRange, SyncType, JobId | 6 | +| [AAD cloud sync Insights.workbook](Identity%20%26%20Access/AAD%20cloud%20sync%20Insights.workbook) | Microsoft Entra cloud sync insights | TimeRange, Status, Action, JobId, SyncType | 11 | +| [AAD cloud sync user details.workbook](Identity%20%26%20Access/AAD%20cloud%20sync%20user%20details.workbook) | Objects synced using cloud sync (AD to Microsoft Entra ID) | TimeRange, JobId, Status, ActionInfo | 3 | +| [AccountActivityReport.workbook](Identity%20%26%20Access/AccountActivityReport.workbook) | AAD-Domain Services: Account Activity Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, TileView, name | 18 | +| [App Consent Audit.workbook](Identity%20%26%20Access/App%20Consent%20Audit.workbook) | App Consent Audit | TimeRange, UserName, AppName1, ScopeName1, API_Name1, Consent_Type1 | 7 | +| [appsigninhealth.workbook](Identity%20%26%20Access/appsigninhealth.workbook) | App sign-in health | Workspace | 6 | +| [ArchivedLogDateRange.workbook](Identity%20%26%20Access/ArchivedLogDateRange.workbook) | Azure AD Sign-in and Audit Log Date Ranges | — | 5 | +| [Authentication Prompts Analysis.workbook](Identity%20%26%20Access/Authentication%20Prompts%20Analysis.workbook) | Authentication Prompts Analysis | — | 50 | +| [authmethodsactivity.workbook](Identity%20%26%20Access/authmethodsactivity.workbook) | Authentication Methods Activity | Workspace | 17 | +| [Client Activity and Status.workbook](Identity%20%26%20Access/Client%20Activity%20and%20Status.workbook) | Client Activity and Status Workbook (Preview) | LogAnalyticWorkspace, TimeRange, Users | 14 | +| [conditionalAccessGapAnalyzer.workbook](Identity%20%26%20Access/conditionalAccessGapAnalyzer.workbook) | Conditional Access Gaps and Recommendations | time_range | 37 | +| [ConditionalAccessInsightsAndReporting.workbook](Identity%20%26%20Access/ConditionalAccessInsightsAndReporting.workbook) | Conditional Access insights and reporting | Workspace, Guide | 51 | +| [cross-tenant-access-activity.workbook](Identity%20%26%20Access/cross-tenant-access-activity.workbook) | Cross-tenant inbound and outbound access activity for Azure AD tenants | Workspace, Guide | 31 | +| [Discovered Application Segments.workbook](Identity%20%26%20Access/Discovered%20Application%20Segments.workbook) | Discovered Application Segments Workbook (Preview) | LogAnalyticWorkspace | 23 | +| [Enriched Microsoft 365 logs.workbook](Identity%20%26%20Access/Enriched%20Microsoft%20365%20logs.workbook) | Enriched Microsoft 365 logs Workbook | LogAnalyticWorkspace, TimeRange, Users | 36 | +| [EntitlementManagementAccessPackageActivity.workbook](Identity%20%26%20Access/EntitlementManagementAccessPackageActivity.workbook) | Entitlement Management Access Package Activity | Since, AccessPackageId | 3 | +| [EntitlementManagementAppRoleAssignments.workbook](Identity%20%26%20Access/EntitlementManagementAppRoleAssignments.workbook) | Application role assignment activity | Time, Activities, Appname, ExcludedInitiatorAppName | 3 | +| [Guest Usage Monitoring Workbook (2).workbook](Identity%20%26%20Access/Guest%20Usage%20Monitoring%20Workbook%20%282%29.workbook) | This is a Workbook designed to help organizations gain clear insight into their Entra Gov… | — | 19 | +| [Guest Usage Monitoring Workbook.workbook](Identity%20%26%20Access/Guest%20Usage%20Monitoring%20Workbook.workbook) | This is a Workbook designed to help organizations gain clear insight into their Entra Gov… | — | 19 | +| [IdentityProtectionRiskAnalysis.workbook](Identity%20%26%20Access/IdentityProtectionRiskAnalysis.workbook) | Identity Protection Risk Analysis | Workspace, Guide, Time | 36 | +| [Impact analysis of risk based access policies.workbook](Identity%20%26%20Access/Impact%20analysis%20of%20risk%20based%20access%20policies.workbook) | Impact analysis of risk-based access policies | Worksapce, Guide | 51 | +| [Legacy Authentication (Preview).workbook](Identity%20%26%20Access/Legacy%20Authentication%20%28Preview%29.workbook) | Sign-ins using Legacy Authentication | TimeRange, Apps, Users | 11 | +| [MCP Insights.workbook](Identity%20%26%20Access/MCP%20Insights.workbook) | MCP Servers Dashboard (Preview) | LogAnalyticWorkspace, TimeRange | 18 | +| [MultiFactorAuthenticationGaps.workbook](Identity%20%26%20Access/MultiFactorAuthenticationGaps.workbook) | Multi-Factor Authentication Gaps for Tenants using Conditional Access | timeRange, Workspace, FilterDQ, Apps, FilterLegacy, DeviceState, … | 14 | +| [Network Traffic Insights.workbook](Identity%20%26%20Access/Network%20Traffic%20Insights.workbook) | Network Traffic Insights Workbook (Preview) | LogAnalyticWorkspace, TimeRange, Users, WebCategories | 28 | +| [Phishing-Resistant Passwordless.workbook](Identity%20%26%20Access/Phishing-Resistant%20Passwordless.workbook) | Phishing-Resistant Passwordless Workbook (Preview) | Workbook, Subscription | 115 | +| [Provisioning Insights.workbook](Identity%20%26%20Access/Provisioning%20Insights.workbook) | Provisioning insights | Source, Destination | 34 | +| [ProvisioningAnalysis.workbook](Identity%20%26%20Access/ProvisioningAnalysis.workbook) | Provisioning Logs | TimeRange, JobId, Status, App | 15 | +| [Remote Network Health.workbook](Identity%20%26%20Access/Remote%20Network%20Health.workbook) | Remote Network Health Workbook (Preview) | LogAnalyticWorkspace, TimeRange, Users | 11 | +| [RiskyIPReportWorkbook.workbook](Identity%20%26%20Access/RiskyIPReportWorkbook.workbook) | Risky IP report (AD FS) | ShowHelp | 17 | +| [SecurityOverviewReport.workbook](Identity%20%26%20Access/SecurityOverviewReport.workbook) | AAD-Domain Services: Security Overview Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, TileView, TimeView | 15 | +| [SensitiveOperations.workbook](Identity%20%26%20Access/SensitiveOperations.workbook) | Sensitive Operations Report - Apps, Service Principals and Federation Settings | Workspace | 27 | +| [Sign-Ins Interactive vs Non-Interactive Workbook.workbook](Identity%20%26%20Access/Sign-Ins%20Interactive%20vs%20Non-Interactive%20Workbook.workbook) | Interactive vs Non-Interactive Sign-ins | TimeRange, Apps, Users | 14 | +| [SignInFailureAnalysis.workbook](Identity%20%26%20Access/SignInFailureAnalysis.workbook) | Troubleshooting Sign-ins | TimeRange, Apps, Users | 7 | +| [SignIns (2).workbook](Identity%20%26%20Access/SignIns%20%282%29.workbook) | Sign-ins using legacy authentication | Workspace, Guide | 17 | +| [SignIns.workbook](Identity%20%26%20Access/SignIns.workbook) | Sign-in Analysis | TimeRange, Apps, Users | 19 | +| [SignInsAADADFS.workbook](Identity%20%26%20Access/SignInsAADADFS.workbook) | Sign-in Analysis Workbook (Preview) | ShowHelp | 39 | +| [SigninsByCAEStatus.workbook](Identity%20%26%20Access/SigninsByCAEStatus.workbook) | Continuous access evaluation token insights | — | 13 | +| [SigninsByCAStatus.workbook](Identity%20%26%20Access/SigninsByCAStatus.workbook) | Sign-ins using Conditional Access (Deprecated) | TimeRange, Apps, Users | 5 | +| [SignInsByGrantControls.workbook](Identity%20%26%20Access/SignInsByGrantControls.workbook) | Sign-ins by Grant Controls (Deprecated) | TimeRange, Apps, Users | 4 | +| [Single Policy Insights (Preview).workbook](Identity%20%26%20Access/Single%20Policy%20Insights%20%28Preview%29.workbook) | Conditional Access Insights | Policy, TimeRange, User, App, unit | 21 | +| [singlepolicyinsights.workbook](Identity%20%26%20Access/singlepolicyinsights.workbook) | Conditional Access Insights | Policy, TimeRange, User, App, unit | 21 | +| [SSPR Reset Funnel.workbook](Identity%20%26%20Access/SSPR%20Reset%20Funnel.workbook) | Self-service Password Reset Funnel and Troubleshooting | Date, Users | 6 | +| [StagedRollout.workbook](Identity%20%26%20Access/StagedRollout.workbook) | Staged Rollout users/groups and sign-ins | TimeRange | 12 | +| [Tenant Restriction Insights.workbook](Identity%20%26%20Access/Tenant%20Restriction%20Insights.workbook) | Tenant restriction insights | TimeRange | 10 | + +## Integration & Messaging + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [Analytics.workbook](Integration%20%26%20Messaging/Analytics.workbook) | Analytics | TimeRange | 35 | +| [Compute.workbook](Integration%20%26%20Messaging/Compute.workbook) | The below graphs describe the App Service Plans associated with the above Logic Apps. | APIs | 10 | +| [Email_Insights.workbook](Integration%20%26%20Messaging/Email_Insights.workbook) | Email_Insights | email_time, email_time_bucket, email_mailfrom | 18 | +| [FilteredAPIM (2).workbook](Integration%20%26%20Messaging/FilteredAPIM%20%282%29.workbook) | FilteredAPIM (2) | TimeRange, Apim, ApplicationInsights, Api | 9 | +| [FilteredAPIM.workbook](Integration%20%26%20Messaging/FilteredAPIM.workbook) | FilteredAPIM | TimeRange, Apim, ApplicationInsights, Api | 9 | +| [FilteredServiceBus.workbook](Integration%20%26%20Messaging/FilteredServiceBus.workbook) | FilteredServiceBus | ServiceBusResource, TimeRange, ServiceBusDictionaryFromUX, TopicsAndQueues | 38 | +| [Insights (2).workbook](Integration%20%26%20Messaging/Insights%20%282%29.workbook) | Start editing the Overview section here | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 8 | +| [Insights (3).workbook](Integration%20%26%20Messaging/Insights%20%283%29.workbook) | {Message} Event hubs | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 9 | +| [Insights (4).workbook](Integration%20%26%20Messaging/Insights%20%284%29.workbook) | {Message} Service Bus Namespaces | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 8 | +| [Insights.workbook](Integration%20%26%20Messaging/Insights.workbook) | {Message} Event Grid Domains | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 9 | +| [Insights_Beta.workbook](Integration%20%26%20Messaging/Insights_Beta.workbook) | Communication Service | time_range, time_granularity | 168 | +| [Insights_legacy.workbook](Integration%20%26%20Messaging/Insights_legacy.workbook) | Communication Service | time_range, time_granularity | 129 | +| [IntegrationAccountTracking.workbook](Integration%20%26%20Messaging/IntegrationAccountTracking.workbook) | IntegrationAccountTracking | TimeRange, IntegrationAccountResourceId, TrackingStoreDetails, KustoCluster, Database | 21 | +| [IntegrationEnvironment.workbook](Integration%20%26%20Messaging/IntegrationEnvironment.workbook) | To ensure the dashboard renders correctly, please make sure that telemetry from all resou… | Subscription, LogicApps, ServiceBus, Apim, Api, Topics, … | 7 | +| [IntegrationEnvironmentApplication.workbook](Integration%20%26%20Messaging/IntegrationEnvironmentApplication.workbook) | IntegrationEnvironmentApplication | Subscription, ServiceBus, Apim, Api, Topics, Queues, … | 6 | +| [IntegrationEnvironmentInsights.workbook](Integration%20%26%20Messaging/IntegrationEnvironmentInsights.workbook) | Select a row above to see alerts for that application. | IntegrationEnvironment, TimeRange | 4 | +| [IntegrationLogicApps (2).workbook](Integration%20%26%20Messaging/IntegrationLogicApps%20%282%29.workbook) | IntegrationLogicApps (2) | LogicApp | 2 | +| [IntegrationLogicApps.workbook](Integration%20%26%20Messaging/IntegrationLogicApps.workbook) | IntegrationLogicApps | IntegrationEnvironmentApplication, APIs, LogicApps, WorkflowNames | 5 | +| [LAStandardMetrics.workbook](Integration%20%26%20Messaging/LAStandardMetrics.workbook) | LAStandardMetrics | LogicApp, ApplicationInsights | 2 | +| [Overview (2).workbook](Integration%20%26%20Messaging/Overview%20%282%29.workbook) | Communication Service | time_range, time_granularity | 129 | +| [Overview.workbook](Integration%20%26%20Messaging/Overview.workbook) | Overview | APIs | 16 | +| [ResourceInsights.workbook](Integration%20%26%20Messaging/ResourceInsights.workbook) | ResourceInsights | Resource, TimeRange | 39 | +| [Rooms_Insights.workbook](Integration%20%26%20Messaging/Rooms_Insights.workbook) | Communication Service | time_range | 9 | +| [Runs.workbook](Integration%20%26%20Messaging/Runs.workbook) | Select a Logic App and Workflow row combination above to drill down into run details. | APIs | 10 | +| [SingleLALogBasedRunOverview.workbook](Integration%20%26%20Messaging/SingleLALogBasedRunOverview.workbook) | If no workflow data is available, please check the following: - The globally selected App… | ApplicationInsights, LogicApp, TimeRange | 7 | +| [SingleLATemplate.workbook](Integration%20%26%20Messaging/SingleLATemplate.workbook) | The metrics below refer to your app service plan: {AppServicePlan:id} | LogicApp, AppServicePlan, TimeRange | 22 | +| [Voice_Video.workbook](Integration%20%26%20Messaging/Voice_Video.workbook) | Voice_Video | — | 7 | +| [Voice_Video_2024.workbook](Integration%20%26%20Messaging/Voice_Video_2024.workbook) | Calling SDK Reliability | — | 67 | +| [Voice_Video_Performance.workbook](Integration%20%26%20Messaging/Voice_Video_Performance.workbook) | Calling SDK Performance | — | 17 | +| [Voice_Video_Quality.workbook](Integration%20%26%20Messaging/Voice_Video_Quality.workbook) | The Quality tab within "Voice and video" displays counts and ratios of key entities that… | — | 12 | +| [Voice_Video_Reliability.workbook](Integration%20%26%20Messaging/Voice_Video_Reliability.workbook) | Calling SDK Reliability | — | 20 | +| [Voice_Video_UFD.workbook](Integration%20%26%20Messaging/Voice_Video_UFD.workbook) | User Facing Diagnostics | — | 17 | +| [Voice_Video_Volume.workbook](Integration%20%26%20Messaging/Voice_Video_Volume.workbook) | Volume tab displays count of calls, count of participants, and call duration over a selec… | — | 21 | + +## IoT + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [IoT Edge device details (2).workbook](IoT/IoT%20Edge%20device%20details%20%282%29.workbook) | No metrics data from IoT Edge devices detected in the {timeRange:label} | invokedFromFleetViewWorkbook, SelectedResource, Subscription, ResourceType, CurrentWorkbooksResource | 89 | +| [IoT Edge device details.workbook](IoT/IoT%20Edge%20device%20details.workbook) | No metrics data from IoT Edge devices detected in the {timeRange:label} | invokedFromFleetViewWorkbook, SelectedResource, Subscription, ResourceType, CurrentWorkbooksResource | 89 | +| [IoT Edge fleet alerts.workbook](IoT/IoT%20Edge%20fleet%20alerts.workbook) | No metrics data from IoT Edge devices detected in the last 3 days | resourceType, resource, InsightsMetricsExists | 16 | +| [IoT Edge Fleet view.workbook](IoT/IoT%20Edge%20Fleet%20view.workbook) | No metrics data from IoT Edge devices detected in the {timeRange:label} | Subscription, CurrentWorkbooksResource, ResourceType, IoTResources, timeRange | 33 | +| [IoT Edge health snapshot (2).workbook](IoT/IoT%20Edge%20health%20snapshot%20%282%29.workbook) | This workbook is designed to be invoked from the IoT Edge Fleet view workbook. | SelectedResource, Subscription, ResourceType, invokedFromFleetViewWorkbook | 21 | +| [IoT Edge health snapshot.workbook](IoT/IoT%20Edge%20health%20snapshot.workbook) | This workbook is designed to be invoked from the IoT Edge Fleet view workbook. | SelectedResource, Subscription, ResourceType, invokedFromFleetViewWorkbook | 21 | +| [IoT Edge.workbook](IoT/IoT%20Edge.workbook) | No metrics data from IoT Edge devices detected in the {timeRange:label} | Subscription, CurrentWorkbooksResource, ResourceType, IoTResources, timeRange | 33 | +| [PlatformAccount Message Counts.workbook](IoT/PlatformAccount%20Message%20Counts.workbook) | PlatformAccount Message Counts | Resource | 4 | + +## Monitoring & Management + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [_api test v1.4.6 (1).workbook](Monitoring%20%26%20Management/_api%20test%20v1.4.6%20%281%29.workbook) | Please select a Time Range: use [Incident Time select] parameter above | Subscription, Workspace, resourceGroup, top, apiTimeRange, Help | 23 | +| [Active alert error detail.workbook](Monitoring%20%26%20Management/Active%20alert%20error%20detail.workbook) | Active alert error detail | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, SelectedAlertSubtype, SelectedUpdateCategory | 3 | +| [Active alerts device detail.workbook](Monitoring%20%26%20Management/Active%20alerts%20device%20detail.workbook) | Active alerts device detail | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _SelectedAlertSubtype, _SelectedAlertType, … | 4 | +| [Active alerts.workbook](Monitoring%20%26%20Management/Active%20alerts.workbook) | Active alerts | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime | 3 | +| [ActivityLogsInsights (2).workbook](Monitoring%20%26%20Management/ActivityLogsInsights%20%282%29.workbook) | NOTE It is required to enable Log Analytics in Diagnotic Settings for this workbook to wo… | CurrentResource, TimeRange | 41 | +| [ActivityLogsInsights.workbook](Monitoring%20%26%20Management/ActivityLogsInsights.workbook) | NOTE It is required to enable Log Analytics in Diagnostic Settings for this workbook to w… | ResourceTypes, Subscription, CurrentResource, TimeRange | 42 | +| [ADAssessment.workbook](Monitoring%20%26%20Management/ADAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [ADSecurityAssessment.workbook](Monitoring%20%26%20Management/ADSecurityAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [Agent Health (2).workbook](Monitoring%20%26%20Management/Agent%20Health%20%282%29.workbook) | Agent health | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, UnhealthyCriteria, HasHeartbeat | 9 | +| [Agent Health Overview.workbook](Monitoring%20%26%20Management/Agent%20Health%20Overview.workbook) | Log Analytics Agent Health | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, UnhealthyCriteria, HasHeartbeat | 20 | +| [Agent Health Service Performance.workbook](Monitoring%20%26%20Management/Agent%20Health%20Service%20Performance.workbook) | Windows Agent Performance - HealthService | DefaultSubscription_Internal, Subscription, Workspace, TimeRange | 11 | +| [Agent Health.workbook](Monitoring%20%26%20Management/Agent%20Health.workbook) | Agent health | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, UnhealthyCriteria, HasHearbeat | 9 | +| [Agent Monitoring Host Performance.workbook](Monitoring%20%26%20Management/Agent%20Monitoring%20Host%20Performance.workbook) | Windows Agent Performance - MonitoringHost | DefaultSubscription_Internal, Subscription, Workspace, TimeRange | 6 | +| [AHB.workbook](Monitoring%20%26%20Management/AHB.workbook) | Azure Hybrid Benefit | — | 168 | +| [Alerts for driver updates.workbook](Monitoring%20%26%20Management/Alerts%20for%20driver%20updates.workbook) | Policy Id: {PolicyId} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, PolicyId, _CatalogId, … | 9 | +| [Alerts for Target build.workbook](Monitoring%20%26%20Management/Alerts%20for%20Target%20build.workbook) | Alerts for target build: {TargetBuild} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _TargetBuild, _TargetVersion, … | 9 | +| [Alerts.workbook](Monitoring%20%26%20Management/Alerts.workbook) | 💡 Select one or more severities to see more information. | Subscription, ResourceGroups, ResourceTypes, Resources, timeRange, State | 10 | +| [AMA Health.workbook](Monitoring%20%26%20Management/AMA%20Health.workbook) | Azure Monitor Agent Health | Subscription, WSSub, Workspace, TimeRangeSelect, UnhealthyCriteria, selectedTab | 46 | +| [AMA Migration Helper.workbook](Monitoring%20%26%20Management/AMA%20Migration%20Helper.workbook) | Azure Monitor Migration Helper | Subscription, Workspace, TimeRange | 72 | +| [App summary.workbook](Monitoring%20%26%20Management/App%20summary.workbook) | {Application:name} | TimeRange, Application | 8 | +| [At Scale Insights.workbook](Monitoring%20%26%20Management/At%20Scale%20Insights.workbook) | Overview section | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 6 | +| [AzMon Dedicated Cluster.workbook](Monitoring%20%26%20Management/AzMon%20Dedicated%20Cluster.workbook) | Azure Monitor Logs Dedicated Clusters (Preview) | selectedTab, AzMonCluSubs, TimeRange, WSSubs | 41 | +| [Azure DevOps.workbook](Monitoring%20%26%20Management/Azure%20DevOps.workbook) | Create an Azure Dev Ops Work Item | operationid, timestamp, httpendpoint, eventid, eventlink, hidewelcome, … | 7 | +| [Azure Resource Locations.workbook](Monitoring%20%26%20Management/Azure%20Resource%20Locations.workbook) | Azure Resource Locations | Subscription, ResourceType | 5 | +| [Azure Services Retirement Preview.workbook](Monitoring%20%26%20Management/Azure%20Services%20Retirement%20Preview.workbook) | Services Retirement Workbook | FullList | 14 | +| [Azure Services Retirement.workbook](Monitoring%20%26%20Management/Azure%20Services%20Retirement.workbook) | Service Retirement Workbook | FullList | 19 | +| [Azure Update Management Center.workbook](Monitoring%20%26%20Management/Azure%20Update%20Management%20Center.workbook) | This section is dynamic, by selecting a row that row's Maintenance configuration id will… | Subscription, Location, ResourceType, TimeRange | 20 | +| [Azure Update Manager Report.workbook](Monitoring%20%26%20Management/Azure%20Update%20Manager%20Report.workbook) | Azure Update Manager Report | — | 7 | +| [AzureAssessment.workbook](Monitoring%20%26%20Management/AzureAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [AzureCost.workbook](Monitoring%20%26%20Management/AzureCost.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 102 | +| [Cohort Analysis.workbook](Monitoring%20%26%20Management/Cohort%20Analysis.workbook) | Cohort Analysis | CohortingActivities, CohortingFilters, RetainingActivities, RetainingFilters | 13 | +| [commitment (2).workbook](Monitoring%20%26%20Management/commitment%20%282%29.workbook) | Commitment-based savings | — | 39 | +| [commitment.workbook](Monitoring%20%26%20Management/commitment.workbook) | Commitment-based savings | — | 39 | +| [compliance-tab.workbook](Monitoring%20%26%20Management/compliance-tab.workbook) | Machines distribution by OS and Resource type | — | 32 | +| [Compute.workbook](Monitoring%20%26%20Management/Compute.workbook) | Virtual Machines | — | 21 | +| [Cosmos Databases.workbook](Monitoring%20%26%20Management/Cosmos%20Databases.workbook) | Start editing the Overview section here | InputContext, ResourceGraphQuery, Resource, TimeRange, Message | 11 | +| [CostOptimization.workbook](Monitoring%20%26%20Management/CostOptimization.workbook) | Welcome to the cost optimization workbook | mapSubscriptions | 35 | +| [Databases.workbook](Monitoring%20%26%20Management/Databases.workbook) | Idle SQL Elastic Pool | — | 18 | +| [DataConnectorCost.workbook](Monitoring%20%26%20Management/DataConnectorCost.workbook) | Data connector cost | — | 3 | +| [DataIngestionLatency.workbook](Monitoring%20%26%20Management/DataIngestionLatency.workbook) | New workbook | — | 6 | +| [DeliveryOptimization (2).workbook](Monitoring%20%26%20Management/DeliveryOptimization%20%282%29.workbook) | Delivery Optimization Status | _SnapshotTime, _WorkbookContext | 17 | +| [DeliveryOptimization.workbook](Monitoring%20%26%20Management/DeliveryOptimization.workbook) | Delivery Optimization Status | mappedSubscription, mappedWorkspace, _WorkbookContext, DOSnapshotTime, isDOOnboarded | 26 | +| [Dependency Failures.workbook](Monitoring%20%26%20Management/Dependency%20Failures.workbook) | Troubleshooting Dependency Failures | TimeRange, Dependencies, ResultCodes, Show, UseComparisonTimeRangeOf | 10 | +| [Device Alerts.workbook](Monitoring%20%26%20Management/Device%20Alerts.workbook) | Alerts | _ShowPills | 9 | +| [Device driver alert.workbook](Monitoring%20%26%20Management/Device%20driver%20alert.workbook) | Alerts | _ShowPills | 7 | +| [Device driver information.workbook](Monitoring%20%26%20Management/Device%20driver%20information.workbook) | {DeviceName} | _ShowPills | 4 | +| [Device information.workbook](Monitoring%20%26%20Management/Device%20information.workbook) | {DeviceName} | _ShowPills | 4 | +| [Devices list for Alert Subtype.workbook](Monitoring%20%26%20Management/Devices%20list%20for%20Alert%20Subtype.workbook) | Devices for : {AlertSubtype} ({DevicesCount}) | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _AlertSubtype, _UpdateReleaseTime, … | 7 | +| [Devices taking a driver update.workbook](Monitoring%20%26%20Management/Devices%20taking%20a%20driver%20update.workbook) | Policy Id: {PolicyId} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _PolicyId, _DeviceCount, … | 5 | +| [DO ContentType breakout.workbook](Monitoring%20%26%20Management/DO%20ContentType%20breakout.workbook) | CONTENT TYPE DETAILS | mappedSubscription, mappedWorkspace, DOSnapshotTime, _WorkbookContext, ContentType, AzureADTenantId, … | 3 | +| [DO Device Configuration breakdown.workbook](Monitoring%20%26%20Management/DO%20Device%20Configuration%20breakdown.workbook) | DEVICE DETAILS | mappedSubscription, mappedWorkspace, DOSnapshotTime, _WorkbookContext, Configuration, AzureADTenantId, … | 3 | +| [Driver alerts information.workbook](Monitoring%20%26%20Management/Driver%20alerts%20information.workbook) | Alerts | _ShowPills | 7 | +| [Driver updates.workbook](Monitoring%20%26%20Management/Driver%20updates.workbook) | The Driver Update workbook provides information about the status of driver updates across… | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime | 17 | +| [Enable MSFT tenant access.workbook](Monitoring%20%26%20Management/Enable%20MSFT%20tenant%20access.workbook) | Enable cross-tenant query access on your Azure Monitor workspace | Workspace, location, apiVersion, allowedTenants, selectedTenant | 17 | +| [Error Codes for Alert Subtype.workbook](Monitoring%20%26%20Management/Error%20Codes%20for%20Alert%20Subtype.workbook) | {AlertSubtype} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _ErrorCode, _AlertClassification, … | 6 | +| [Exceptions.workbook](Monitoring%20%26%20Management/Exceptions.workbook) | Troubleshooting Exceptions | TimeRange, Problems, Show, UseComparisonTimeRangeOf | 10 | +| [ExchangeAssessment.workbook](Monitoring%20%26%20Management/ExchangeAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [ExchangeOnlineAssessment.workbook](Monitoring%20%26%20Management/ExchangeOnlineAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [Expedite alerts for target build.workbook](Monitoring%20%26%20Management/Expedite%20alerts%20for%20target%20build.workbook) | Alerts for Deployment Id: {DeploymentId} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _TargetBuild, _TargetVersion, … | 11 | +| [Expedite deployment view.workbook](Monitoring%20%26%20Management/Expedite%20deployment%20view.workbook) | Expedite status | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, Page | 10 | +| [Expedite target build.workbook](Monitoring%20%26%20Management/Expedite%20target%20build.workbook) | {DeviceCount} Devices : {TargetVersion} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _TargetVersion, _TargetBuild, … | 12 | +| [Failure Analysis.workbook](Monitoring%20%26%20Management/Failure%20Analysis.workbook) | Application Failure Analysis | DefaultSubscription_Internal, Subscription, Apps, TimeRange | 10 | +| [Feature updates.workbook](Monitoring%20%26%20Management/Feature%20updates.workbook) | The Feature Updates workbook provides information about the status of feature updates acr… | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime | 20 | +| [findComputersMissingInLogs v0.1.workbook](Monitoring%20%26%20Management/findComputersMissingInLogs%20v0.1.workbook) | Show Azure Resources that are not in Log Analytics | DefaultWorkspace, ContextFree, Selection | 17 | +| [findComputersMissingInLogs v0.2.workbook](Monitoring%20%26%20Management/findComputersMissingInLogs%20v0.2.workbook) | Show Azure Resources that are not in Log Analytics | DefaultWorkspace, ContextFree, Selection | 20 | +| [FindComputersMissingInLogs.workbook](Monitoring%20%26%20Management/FindComputersMissingInLogs.workbook) | Show Azure Resources that are not in Log Analytics | DefaultWorkspace, ContextFree, Selection | 15 | +| [Get started with Update Compliance.workbook](Monitoring%20%26%20Management/Get%20started%20with%20Update%20Compliance.workbook) | New policy required A new policy is required to use Update Compliance: "AllowUpdateCompli… | currentTab | 12 | +| [GitHub.workbook](Monitoring%20%26%20Management/GitHub.workbook) | Create a GitHub Work Item | operationid, timestamp, httpendpoint, eventid, eventlink, hidewelcome, … | 7 | +| [Helpful Links.workbook](Monitoring%20%26%20Management/Helpful%20Links.workbook) | Getting started resources | — | 1 | +| [Hotpatch Status.workbook](Monitoring%20%26%20Management/Hotpatch%20Status.workbook) | Ineligible devices: One or more pre-requisites for Hotpatch updates are not met. | mappedSubscription, mappedWorkspace, _SnapshotTime, Page | 8 | +| [Hotpatch Updates Device List.workbook](Monitoring%20%26%20Management/Hotpatch%20Updates%20Device%20List.workbook) | Hotpatch Updates Device List | mappedSubscription, mappedWorkspace, _SnapshotTime, TargetBuild, UpdateDisplayName | 3 | +| [installationhistory-tab.workbook](Monitoring%20%26%20Management/installationhistory-tab.workbook) | Windows | — | 13 | +| [JSONPathParamSample.workbook](Monitoring%20%26%20Management/JSONPathParamSample.workbook) | For example, you may have a string parameter named selection that was the result of a que… | selection | 2 | +| [KPI Card Detail.workbook](Monitoring%20%26%20Management/KPI%20Card%20Detail.workbook) | {Title} {Subtitle} | Title, _SnapshotTime, mappedSubscription, mappedWorkspace, DataQuery, Subtitle | 3 | +| [LA Workspace Insights Agents.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20Agents.workbook) | LA Workspace Insights Agents | TimeRange | 12 | +| [LA Workspace Insights ChangeLog.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20ChangeLog.workbook) | LA Workspace Insights ChangeLog | Resource | 5 | +| [LA Workspace Insights DCRs.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20DCRs.workbook) | LA Workspace Insights DCRs | Resource, WorkspaceSystemDCE | 7 | +| [LA Workspace Insights Health.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20Health.workbook) |  Resource Health (not affected by the time range) | — | 8 | +| [LA Workspace Insights Overview.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20Overview.workbook) | No data was ingested to this workspace over the past month. | Resource, TopDataTypes, DailyCap, MonthlyIngestionMB | 15 | +| [LA Workspace Insights QueryAudit.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20QueryAudit.workbook) | Query Audit records not found. | Resource | 16 | +| [LA Workspace Insights Usage.workbook](Monitoring%20%26%20Management/LA%20Workspace%20Insights%20Usage.workbook) | The following queries are extensive and could take a while to complete. They are therefor… | TimeRange | 30 | +| [LegacyWorkbookConversion.workbook](Monitoring%20%26%20Management/LegacyWorkbookConversion.workbook) | Legacy (Favorites based) Workbook Conversion | resource | 5 | +| [LinkSample.workbook](Monitoring%20%26%20Management/LinkSample.workbook) | selectedTab is {selectedTab} | — | 4 | +| [Metrics Usage Insights.workbook](Monitoring%20%26%20Management/Metrics%20Usage%20Insights.workbook) | Please ensure this AMW has been successfully onboarded to Diagnostic Settings. | Amw, DiagnosticSettingsEnabled | 39 | +| [Networking.workbook](Monitoring%20%26%20Management/Networking.workbook) | Recommendations for Application Gateways | — | 43 | +| [New.workbook](Monitoring%20%26%20Management/New.workbook) | New | — | 0 | +| [noSubscriptions.workbook](Monitoring%20%26%20Management/noSubscriptions.workbook) | No Subscriptions are selected. | ResourceImageUrl, ResourceName | 4 | +| [OpenTelemetry Metrics.workbook](Monitoring%20%26%20Management/OpenTelemetry%20Metrics.workbook) | Your Azure Monitor workspace could not be reached. | timerange, AppInsightsInstance, Prometheus | 14 | +| [operationshistory-tab.workbook](Monitoring%20%26%20Management/operationshistory-tab.workbook) | Patch installation history by maintenance run | Subscription, Location, ResourceType, TimeRange | 19 | +| [pendingupdates-tab.workbook](Monitoring%20%26%20Management/pendingupdates-tab.workbook) | Windows | — | 19 | +| [Performance Analysis.workbook](Monitoring%20%26%20Management/Performance%20Analysis.workbook) | Application Performance Analysis | DefaultSubscription_Internal, Subscription, Apps, TimeRange, Metric | 10 | +| [Performance Counter TSG.workbook](Monitoring%20%26%20Management/Performance%20Counter%20TSG.workbook) | Troubleshooting Issues Using Performance Counters | TimeRange | 7 | +| [PrivateWorkbookConversion.workbook](Monitoring%20%26%20Management/PrivateWorkbookConversion.workbook) | Private Workbook Conversion | Subscription, ResourceGroup, Category | 5 | +| [Prometheus Explorer.workbook](Monitoring%20%26%20Management/Prometheus%20Explorer.workbook) | You currently do not have any Prometheus data ingested to this Azure Monitor workspace, t… | timerange, Prometheus, PromQL | 9 | +| [QC - Lighthouse (v1.0.0).workbook](Monitoring%20%26%20Management/QC%20-%20Lighthouse%20%28v1.0.0%29.workbook) | sentinel-LighthouseWorkbook | region, Subscription, selectCustomer, Workspace, TimeRange, Help, … | 3 | +| [Quality updates.workbook](Monitoring%20%26%20Management/Quality%20updates.workbook) | Quality updates deliver both security and non-security fixes. | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime | 21 | +| [recommendations-tab.workbook](Monitoring%20%26%20Management/recommendations-tab.workbook) | Please use 'Customer Managed Schedules' mode and set up Scheduled updates, or use 'Azure… | — | 20 | +| [ReliabilityWorkbookAzureSiteRecovery.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookAzureSiteRecovery.workbook) | SLA for Azure Site Recovery For each Protected Instance configured for On-Premises-to-On-… | — | 8 | +| [ReliabilityWorkbookCompute.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookCompute.workbook) | SLA for Virtual Machines For all Virtual Machines that have two or more instances deploye… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 15 | +| [ReliabilityWorkbookContainers.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookContainers.workbook) | SLA for Azure Kubernetes Service (AKS) For customers who have purchased an Azure Kubernet… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 6 | +| [ReliabilityWorkbookDatabases.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookDatabases.workbook) | SLA for Azure SQL Database Azure SQL Database Business Critical or Premium tiers configur… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 37 | +| [ReliabilityWorkbookIntegration.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookIntegration.workbook) | SLA for API Management We guarantee that API Management Service instances running in the… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 4 | +| [ReliabilityWorkbookNetworking.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookNetworking.workbook) | SLA for Load Balancer We guarantee that a Load Balanced Endpoint using Azure Standard Loa… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 31 | +| [ReliabilityWorkbookPublic.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookPublic.workbook) | Reliability workbook | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 28 | +| [ReliabilityWorkbookResiliencyScenarios.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookResiliencyScenarios.workbook) | Cross Region Replication | Subscriptions, ResourceGroup, Region, Environment, TagName, TagValue | 11 | +| [ReliabilityWorkbookServiceAlert.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookServiceAlert.workbook) | Service Health alerts allow customers to receive an alert when Azure sends service health… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 8 | +| [ReliabilityWorkbookStorage.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookStorage.workbook) | SLA for Storage Accounts We guarantee that at least 99.99% (99.9% for Cool Access Tier) o… | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 7 | +| [ReliabilityWorkbookWeb.workbook](Monitoring%20%26%20Management/ReliabilityWorkbookWeb.workbook) | SLA for App Service Plan There is no specific SLA tied to App service plan itself. | Subscriptions, ResourceGroup, Environment, TagName, TagValue, SLA, … | 17 | +| [Request Failures.workbook](Monitoring%20%26%20Management/Request%20Failures.workbook) | Troubleshooting Request Failures | TimeRange, Requests, ResultCodes, Show, UseComparisonTimeRangeOf | 10 | +| [Reservations.workbook](Monitoring%20%26%20Management/Reservations.workbook) | Reserved instances can provide a significant discount over on-demand prices. | — | 6 | +| [ReservationsPreview (2).workbook](Monitoring%20%26%20Management/ReservationsPreview%20%282%29.workbook) | Reservation Recommendations - Overview | — | 20 | +| [ReservationsPreview.workbook](Monitoring%20%26%20Management/ReservationsPreview.workbook) | Reservation Recommendations - Overview | — | 20 | +| [Resource Changes (1).workbook](Monitoring%20%26%20Management/Resource%20Changes%20%281%29.workbook) | Azure Resources Change report | Subscription, Workspace, resourceGroup, TimeRange, Help | 8 | +| [Resource Picker.workbook](Monitoring%20%26%20Management/Resource%20Picker.workbook) | 💡 Learn how to use this template | ResourceTypes, Subscription, ResourceGroups, Resources | 3 | +| [Retention - Bracket.workbook](Monitoring%20%26%20Management/Retention%20-%20Bracket.workbook) | Bracket Retention | CohortingActivities, CohortingFilters, RetainingActivities, RetainingFilters | 9 | +| [Retention - N Period.workbook](Monitoring%20%26%20Management/Retention%20-%20N%20Period.workbook) | N-Period Retention | CohortingActivities, CohortingFilters, RetainingActivities, RetainingFilters | 12 | +| [Retention - Unbounded.workbook](Monitoring%20%26%20Management/Retention%20-%20Unbounded.workbook) | Unbounded Retention | CohortingActivities, CohortingFilters, RetainingActivities, RetainingFilters | 8 | +| [Safeguard hold detail.workbook](Monitoring%20%26%20Management/Safeguard%20hold%20detail.workbook) | Description: Deployment protection settings have placed this device under a Safeguard hol… | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, SafeguardHoldID, CountForSafeguardHoldID | 4 | +| [Safeguard hold view.workbook](Monitoring%20%26%20Management/Safeguard%20hold%20view.workbook) | This view shows the safeguard holds that are active for your population, and how many dev… | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime | 3 | +| [SafeguardHolds.workbook](Monitoring%20%26%20Management/SafeguardHolds.workbook) | Update Compliance - Safeguard Holds | _SnapshotTime | 11 | +| [SavingsPlan.workbook](Monitoring%20%26%20Management/SavingsPlan.workbook) | We analyzed your compute usage over the last 30 days and recommend adding a savings plan… | — | 6 | +| [SCCMAssessment.workbook](Monitoring%20%26%20Management/SCCMAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [schedules-tab.workbook](Monitoring%20%26%20Management/schedules-tab.workbook) | Maintenance configurations | Subscription, Location | 9 | +| [SCOMAssessment.workbook](Monitoring%20%26%20Management/SCOMAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [SfBAssessment.workbook](Monitoring%20%26%20Management/SfBAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [SharePointOnlineAssessment.workbook](Monitoring%20%26%20Management/SharePointOnlineAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [SPAssessment.workbook](Monitoring%20%26%20Management/SPAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [Sql databases.workbook](Monitoring%20%26%20Management/Sql%20databases.workbook) | ⚠️ Looks like you don't have any SQL databases in this resource group. | ResourceGroup, Resources, TimeRange | 3 | +| [SQLAssessment.workbook](Monitoring%20%26%20Management/SQLAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [Storage Accounts (2).workbook](Monitoring%20%26%20Management/Storage%20Accounts%20%282%29.workbook) | 💡 Click on the links in the cells to see more details about a storage account | ResourceGroup, Resources, TimeRange | 4 | +| [Storage Accounts.workbook](Monitoring%20%26%20Management/Storage%20Accounts.workbook) | Overview section | InputContext, ResourceGraphQuery, StorageAccounts, TimeRange, Message | 7 | +| [Storage.workbook](Monitoring%20%26%20Management/Storage.workbook) | Idle backups | — | 33 | +| [Sustainability.workbook](Monitoring%20%26%20Management/Sustainability.workbook) | Carbon Optimization recommendations | — | 5 | +| [Target version.workbook](Monitoring%20%26%20Management/Target%20version.workbook) | {DeviceCount} Devices : {TargetVersion} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _TargetVersion, _DeviceCount, … | 5 | +| [ToolbarSample.workbook](Monitoring%20%26%20Management/ToolbarSample.workbook) | How this workbook works | Subscription, site, properties | 4 | +| [Top10Services.workbook](Monitoring%20%26%20Management/Top10Services.workbook) | Synapse | — | 28 | +| [Total devices.workbook](Monitoring%20%26%20Management/Total%20devices.workbook) | {TotalMissingDeviceCount} devices are currently unavailable in the report. | mappedTenantId, mappedSubscription, mappedWorkspace, _SnapshotTime, isOnboarded, Page | 11 | +| [Update compliance _ Target build.workbook](Monitoring%20%26%20Management/Update%20compliance%20_%20Target%20build.workbook) | {DeviceCount} Devices : {TargetVersion} | mappedSubscription, mappedWorkspace, _WorkbookContext, _SnapshotTime, _TargetVersion, _TargetBuild, … | 10 | +| [Update Compliance Hub.workbook](Monitoring%20%26%20Management/Update%20Compliance%20Hub.workbook) | Windows Update for Business reports | currentWorkbook, mappedTenantId, savedMapping, savedMappingSubscriptionId, savedMappingWorkspaceName, savedMappingResourceGroupName, … | 33 | +| [UpdateCompliance.workbook](Monitoring%20%26%20Management/UpdateCompliance.workbook) | Update Compliance Workbook | TimeRange | 12 | +| [UpdateIngestionLimits.workbook](Monitoring%20%26%20Management/UpdateIngestionLimits.workbook) | UpdateIngestionLimits | Amw, Location | 10 | +| [Usage Analysis.workbook](Monitoring%20%26%20Management/Usage%20Analysis.workbook) | Usage Analysis | DefaultSubscription_Internal, Subscription, Apps, TimeRange, Sources, Count | 10 | +| [Virtual machines CPU use.workbook](Monitoring%20%26%20Management/Virtual%20machines%20CPU%20use.workbook) | ⚠️ Looks like you don't have any virtual machines in this resource group. | ResourceGroup, VirtualMachines, TimeRange, CpuThreshold | 5 | +| [Virtual Machines.workbook](Monitoring%20%26%20Management/Virtual%20Machines.workbook) | 💡 Click on Percentage CPU cell to see more information about the virtual machine | ResourceGroup, VirtualMachines, TimeRange | 4 | +| [WaaSUpdateInsights (1).workbook](Monitoring%20%26%20Management/WaaSUpdateInsights%20%281%29.workbook) | Help file | Subscription, Workspace, TimeRange, Help | 17 | +| [Win11Reporting.workbook](Monitoring%20%26%20Management/Win11Reporting.workbook) | Windows Update for Business reports - Windows 11 Readiness Status | mappedSubscription, mappedWorkspace, _SnapShotTime, _CapabilityStatus | 9 | +| [Windows 11 Status Report.workbook](Monitoring%20%26%20Management/Windows%2011%20Status%20Report.workbook) | Windows 11 Adoption Status | mappedSubscription, mappedWorkspace, _SnapshotTime | 12 | +| [Windows Update for Business reports enrollment.workbook](Monitoring%20%26%20Management/Windows%20Update%20for%20Business%20reports%20enrollment.workbook) |  Tenant ID: {TenantID}  Subscription: {SelectedSubscriptionName:label}  Wo… | TenantID, SavedMapping | 14 | +| [WindowsClientAssessment.workbook](Monitoring%20%26%20Management/WindowsClientAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [WindowsServerAssessment.workbook](Monitoring%20%26%20Management/WindowsServerAssessment.workbook) | Assessment Quality | TimeRange, subsID, culture | 13 | +| [workbooks.workbook](Monitoring%20%26%20Management/workbooks.workbook) | Orphan resources | Subscriptions | 77 | +| [Workspace Health Report v1.4.4 -quickFix.workbook](Monitoring%20%26%20Management/Workspace%20Health%20Report%20v1.4.4%20-quickFix.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 69 | +| [Workspace Insights At Scale.workbook](Monitoring%20%26%20Management/Workspace%20Insights%20At%20Scale.workbook) | {Message} Log Analytics workspace(s) | Subscription, ResourceGroup, Workspace, TimeRange, Message, ResourceName, … | 5 | +| [Workspace Insights.workbook](Monitoring%20%26%20Management/Workspace%20Insights.workbook) | Workspace Insights | TimeRange, Resource, TopDataTypes, DailyCap, SelectedTab | 9 | +| [Workspace Usage (2).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20%282%29.workbook) | Workspace Usage | TimeRange | 8 | +| [Workspace Usage report v1.1.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20report%20v1.1.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, GiBperday, Price | 31 | +| [Workspace Usage report v1.2.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20report%20v1.2.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, GiBperday, Price | 32 | +| [Workspace Usage Report v1.3a.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.3a.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, GiBperday, Price | 36 | +| [Workspace Usage Report v1.4.6.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.4.6.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 102 | +| [Workspace Usage Report v1.4.7.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.4.7.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 118 | +| [Workspace Usage Report v1.4.8.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.4.8.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 156 | +| [Workspace Usage Report v1.5.1a (1).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.5.1a%20%281%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 174 | +| [Workspace Usage Report v1.6.2 (Jan 2026).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.2%20%28Jan%202026%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 236 | +| [Workspace Usage Report v1.6.2.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.2.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 233 | +| [Workspace Usage Report v1.6.3.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.3.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 249 | +| [Workspace Usage Report v1.6.4 (1).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.4%20%281%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 257 | +| [Workspace Usage Report v1.6.4 (3).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.4%20%283%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 263 | +| [Workspace Usage Report v1.6.4 (defender option).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.4%20%28defender%20option%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 279 | +| [Workspace Usage Report v1.6.4.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.4.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 276 | +| [Workspace Usage Report v1.6.5 (1).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%281%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 320 | +| [Workspace Usage Report v1.6.5 (11).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%2811%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 408 | +| [Workspace Usage Report v1.6.5 (12).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%2812%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 408 | +| [Workspace Usage Report v1.6.5 (2).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%282%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 324 | +| [Workspace Usage Report v1.6.5 (3).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%283%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 345 | +| [Workspace Usage Report v1.6.5 (5).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%285%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 352 | +| [Workspace Usage Report v1.6.5 (6).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%286%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 356 | +| [Workspace Usage Report v1.6.5 (7).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%287%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 411 | +| [Workspace Usage Report v1.6.5 (8).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5%20%288%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 405 | +| [Workspace Usage Report v1.6.5a.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.5a.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 405 | +| [Workspace Usage Report v1.6.6.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20Report%20v1.6.6.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 407 | +| [Workspace Usage report.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20report.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, GiBperday, Price | 28 | +| [Workspace Usage V1.6.1.workbook](Monitoring%20%26%20Management/Workspace%20Usage%20V1.6.1.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 224 | +| [Workspace Usage V1.6.2(Sept2022 beta).workbook](Monitoring%20%26%20Management/Workspace%20Usage%20V1.6.2%28Sept2022%20beta%29.workbook) | Workspace Usage Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GBperday, … | 225 | +| [Workspace Usage.workbook](Monitoring%20%26%20Management/Workspace%20Usage.workbook) | Workspace Usage | DefaultSubscription_Internal, Subscription, Workspace, TimeRange | 8 | + +## Networking + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [ACLHits.workbook](Networking/ACLHits.workbook) | ##### Time trending chart for hits of ACLs | timeInterval, workspace, subscriptions, resourceGroups, acls, resourceRules | 18 | +| [Active Ports (2).workbook](Networking/Active%20Ports%20%282%29.workbook) | Port activity by Computer, Process, IP and Port | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 4 | +| [Active Ports.workbook](Networking/Active%20Ports.workbook) | Port activity by Computer, Process, IP and Port | DefaultResource, Context | 5 | +| [AppGwWafDefault.workbook](Networking/AppGwWafDefault.workbook) | Selection Summary: | Resource, detectionTime, Associations | 42 | +| [ApplicationPorts.workbook](Networking/ApplicationPorts.workbook) | Looks like we have only resources data (Topology) and no flow info for the selected works… | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 18 | +| [ChattyConversations (2).workbook](Networking/ChattyConversations%20%282%29.workbook) | ##### Time trending chart for top 5 internal chatty conversations | timeInterval, workspace, subscriptions, resourceGroups, vnets, subnets, … | 18 | +| [ChattyConversations.workbook](Networking/ChattyConversations.workbook) | ##### Time trending chart for top 5 internal chatty conversations | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 19 | +| [Connection Records.workbook](Networking/Connection%20Records.workbook) | Aggregate Connection Records | Workspace, TimeRange | 7 | +| [Connections Overview (2).workbook](Networking/Connections%20Overview%20%282%29.workbook) | Responses | WorkbookResource, resourceType, ConnectionLogs, isOnboarded, DisclaimerText | 21 | +| [Connections Overview (3).workbook](Networking/Connections%20Overview%20%283%29.workbook) | Responses | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 16 | +| [Connections Overview (Azure Preview).workbook](Networking/Connections%20Overview%20%28Azure%20Preview%29.workbook) | Responses | DefaultSubscription, DefaultResourceGroup, SelectedResourceGroup, DefaultWorkspace, Subscription, ResourceGroups, … | 14 | +| [Connections Overview.workbook](Networking/Connections%20Overview.workbook) | Responses | Resource, Test, DisclaimerText | 16 | +| [ERGateway.workbook](Networking/ERGateway.workbook) | ExpressRoute gateway | timeInterval, workspace, subscriptions, resourceGroups, vnets, erGateways, … | 9 | +| [ExpressRouteCircuitMetrics-Minified.workbook](Networking/ExpressRouteCircuitMetrics-Minified.workbook) | ExpressRouteCircuitMetrics-Minified | ExpressRouteCircuit, TimeRange | 4 | +| [ExpressRouteCircuitMetrics.workbook](Networking/ExpressRouteCircuitMetrics.workbook) | Useful documents | ExpressRouteCircuit, TimeRange, ERGateway | 19 | +| [Failed Connections.workbook](Networking/Failed%20Connections.workbook) | ⚠ VMConnection table was either not detected or empty. | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 6 | +| [geoLocation 1.0.workbook](Networking/geoLocation%201.0.workbook) | Help file | Subscription, Workspace, TimeRange, resourceGroup, ipAddress, Help | 10 | +| [geoLocation v1.1.workbook](Networking/geoLocation%20v1.1.workbook) | Help file | Subscription, Workspace, TimeRange, resourceGroup, ipAddress, Help | 13 | +| [geoLocation v1.2.1.workbook](Networking/geoLocation%20v1.2.1.workbook) | Help file | Subscription, Workspace, TimeRange, resourceGroup, ipAddress, WhoisDomanName, … | 18 | +| [geoLocation v1.2.workbook](Networking/geoLocation%20v1.2.workbook) | Help file | Subscription, Workspace, TimeRange, resourceGroup, ipAddress, WhoisDomanName, … | 17 | +| [geoLocation.workbook](Networking/geoLocation.workbook) | Help file | Subscription, Workspace, resourceGroup, ipAddress, Help | 7 | +| [L7Protocol (2).workbook](Networking/L7Protocol%20%282%29.workbook) | ##### Time trending chart for top 5 L7 protocols | timeInterval, workspace, subscriptions, resourceGroups, vnets, subnets, … | 8 | +| [L7Protocol.workbook](Networking/L7Protocol.workbook) | ##### Time trending chart for top 5 L7 protocols | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 10 | +| [NetworkApplications.workbook](Networking/NetworkApplications.workbook) | Looks like we have only resources data (Topology) and no flow info for the selected works… | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 17 | +| [NetworkInsights-AppGatewayMetrics-Minified.workbook](Networking/NetworkInsights-AppGatewayMetrics-Minified.workbook) | NetworkInsights-AppGatewayMetrics-Minified | HideVMSS, HideVMs, HidePublicIPs | 9 | +| [NetworkInsights-AppGatewayMetrics.workbook](Networking/NetworkInsights-AppGatewayMetrics.workbook) | NetworkInsights-AppGatewayMetrics | HideVMSS, HideVMs, HidePublicIPs | 9 | +| [NetworkInsights-ApplicationGatewayMetrics-Minified.workbook](Networking/NetworkInsights-ApplicationGatewayMetrics-Minified.workbook) | NetworkInsights-ApplicationGatewayMetrics-Minified | ApplicationGateway, TimeRange, SKU | 8 | +| [NetworkInsights-ApplicationGatewayMetrics.workbook](Networking/NetworkInsights-ApplicationGatewayMetrics.workbook) | Application gateway total time vs Backend last byte response time | ApplicationGateway, SKU, TimeRange, isDiagnosticLogsEnabled | 78 | +| [NetworkInsights-AzureFirewallMetrics.workbook](Networking/NetworkInsights-AzureFirewallMetrics.workbook) | Azure Firewall Workbook | AzureFirewall, Workspaces, TimeRange | 41 | +| [NetworkInsights-AzureFirewallMetricsStructuredLogs.workbook](Networking/NetworkInsights-AzureFirewallMetricsStructuredLogs.workbook) | Azure Firewall Workbook | TimeRange, Workspaces, Resource, Help, FirewallResources, GeoLocation | 80 | +| [NetworkInsights-LoadBalancerMetrics-Minified.workbook](Networking/NetworkInsights-LoadBalancerMetrics-Minified.workbook) | Load Balancer Key Metrics Basic Load balancers don’t support metrics. | LoadBalancer, BackenVMs, BackendVMSS, SKU, TimeRange, BackendVMs_IPBasedBackendPool | 10 | +| [NetworkInsights-LoadBalancerMetrics.workbook](Networking/NetworkInsights-LoadBalancerMetrics.workbook) | Useful documents | LoadBalancer, BackenVMs, BackendVMs_IPBasedBackendPool, BackendVMSS, FrontendPublicIPs, SKU, … | 54 | +| [NetworkInsights-NatGatewayMetrics-Minified.workbook](Networking/NetworkInsights-NatGatewayMetrics-Minified.workbook) | Useful Documentation | NATGateway, TimeRange | 10 | +| [NetworkInsights-NatGatewayMetrics.workbook](Networking/NetworkInsights-NatGatewayMetrics.workbook) | Useful Documentation | NATGateway, TimeRange | 10 | +| [NetworkInsights-NetworkInterfaceMetrics.workbook](Networking/NetworkInsights-NetworkInterfaceMetrics.workbook) | Useful Documentation | NetworkInterface, TImeRange | 10 | +| [NetworkInsights-PrivateEndpointMetrics.workbook](Networking/NetworkInsights-PrivateEndpointMetrics.workbook) | Useful documents | PrivateEndpoint, PrivateLinkService | 14 | +| [NetworkInsights-PrivateLinkServiceMetrics.workbook](Networking/NetworkInsights-PrivateLinkServiceMetrics.workbook) | Useful documents | PrivateLinkService, PrivateEndpoint | 14 | +| [NetworkInsights-PublicIPMetrics.workbook](Networking/NetworkInsights-PublicIPMetrics.workbook) | Useful documents | PublicIP | 17 | +| [NetworkInsights-VirtualNetworkGatewayMetrics.workbook](Networking/NetworkInsights-VirtualNetworkGatewayMetrics.workbook) | Useful documents | VirtualNetworkGateway, TimeRange, GatewayType | 36 | +| [NetworkInsights-VirtualWANMetrics-Minified.workbook](Networking/NetworkInsights-VirtualWANMetrics-Minified.workbook) | NetworkInsights-VirtualWANMetrics-Minified | virtualWAN, vpnGateway, expressRouteGateway, p2SVpnGateway, azureFirewall, erCircuits, … | 5 | +| [NetworkInsights-VirtualWANMetrics.workbook](Networking/NetworkInsights-VirtualWANMetrics.workbook) | Virtual WAN Regional Hub Status and Hub Capacities (Gbps) | virtualWAN, vpnGateway, expressRouteGateway, p2SVpnGateway, azureFirewall, erCircuits, … | 27 | +| [NSG_ACLHits.workbook](Networking/NSG_ACLHits.workbook) | Looks like we have only resources data (Topology) and no flow info for the selected works… | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 34 | +| [NSGHits.workbook](Networking/NSGHits.workbook) | ##### Time trending chart for hits of NSGs | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 19 | +| [NSPRRWorkbook.workbook](Networking/NSPRRWorkbook.workbook) | Rule Recommendations for Network Security Perimeter (NSP) | timeInterval, workspaceSubscription, workspace, NSPResourceId, isNSPRRSchemaPresent, binningTime, … | 26 | +| [Open Ports.workbook](Networking/Open%20Ports.workbook) | ⚠ VMBoundPort table was either not detected or empty. | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 9 | +| [OverviewPage.workbook](Networking/OverviewPage.workbook) | Looks like we have only resources data (Topology) and no flow info for the selected works… | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 107 | +| [PMEC Site Overview.workbook](Networking/PMEC%20Site%20Overview.workbook) | No Azure Stack Edge device connected to this Packet Core. | timespan, site, mobilenetwork, pccp, ase, kubernetesCluster, … | 39 | +| [PortsReceivingTrafficFromInternet (2).workbook](Networking/PortsReceivingTrafficFromInternet%20%282%29.workbook) | PortsReceivingTrafficFromInternet (2) | timeInterval, workspace, subscriptions, resourceGroups, vnets, subnets | 5 | +| [PortsReceivingTrafficFromInternet.workbook](Networking/PortsReceivingTrafficFromInternet.workbook) | PortsReceivingTrafficFromInternet | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 7 | +| [PublicIP v0.1.workbook](Networking/PublicIP%20v0.1.workbook) | select a workspace to see saved queries. | Subscription, Workspace, TimeRange, Help | 13 | +| [PublicIP v0.2.3release.workbook](Networking/PublicIP%20v0.2.3release.workbook) | Filter by Traffic Direction and Security Rules (Ports): Column naming help | Subscription, Workspace, TimeRange, Help | 25 | +| [Security and Audit.workbook](Networking/Security%20and%20Audit.workbook) | Malicious Traffic | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 18 | +| [TCP Traffic.workbook](Networking/TCP%20Traffic.workbook) | ⚠ VMConnection table was either not detected or empty. | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 5 | +| [TopTalkingHosts (2).workbook](Networking/TopTalkingHosts%20%282%29.workbook) | ##### Time trending chart for top 5 talking IPs | timeInterval, workspace, subscriptions, resourceGroups, vnets, subnets, … | 9 | +| [TopTalkingHosts.workbook](Networking/TopTalkingHosts.workbook) | ##### Time trending chart for top 5 talking IPs | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 10 | +| [Traffic Comparison.workbook](Networking/Traffic%20Comparison.workbook) | ⚠ VMConnection table was either not detected or empty. | DefaultWorkspace, DefaultSubscription, ContextSelection, HybridMode, Subscriptions, Workspaces, … | 10 | +| [TrafficDistribution.workbook](Networking/TrafficDistribution.workbook) | Looks like we have only resources data (Topology) and no flow info for the selected works… | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 66 | +| [User Map V1.4c.workbook](Networking/User%20Map%20V1.4c.workbook) | Tab One. Malicious IP | Subscription, Workspace, TimeRange, Help | 41 | +| [User Map V1.4d.workbook](Networking/User%20Map%20V1.4d.workbook) | Help | Subscription, Workspace, TimeRange, Help | 44 | +| [UserMap.workbook](Networking/UserMap.workbook) | Tab One. Malicious IP | Subscription, Workspace, TimeRange, Help | 35 | +| [VM Events.workbook](Networking/VM%20Events.workbook) | Unexpected VM Reboots | Workspaces, TimeRange | 16 | +| [VMsSendingTrafficToInternet (2).workbook](Networking/VMsSendingTrafficToInternet%20%282%29.workbook) | Details of top IPs sending traffic to Internet | timeInterval, workspace, subscriptions, resourceGroups, vnets, subnets | 4 | +| [VMsSendingTrafficToInternet.workbook](Networking/VMsSendingTrafficToInternet.workbook) | ##### Details of top IPs sending traffic to Internet | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 6 | +| [VNet.workbook](Networking/VNet.workbook) | Filter By: | timeInterval, workspace, FlowType, Units, isVNetTopologySchemaPresent, isVNetFlowSchemaPresent, … | 21 | +| [VPNGateway (2).workbook](Networking/VPNGateway%20%282%29.workbook) | ##### Capacity utilization of selected gateway | timeInterval, workspace, subscriptions, resourceGroups, vnets, vpnGateways, … | 12 | +| [VPNGateway.workbook](Networking/VPNGateway.workbook) | ##### Capacity utilization of selected gateway | timeInterval, timeIntervalFlowlogCheck, timeIntervalTopologyCheck, timeIntervalBothCheck, workspace, subscriptions, … | 12 | +| [YourEnvironment.workbook](Networking/YourEnvironment.workbook) | Deployed Azure Regions | timeInterval, FlowType, workspace, Units, isNSGTopologySchemaPresent, isNSGFlowSchemaPresent, … | 22 | + +## SAP & Industry Workloads + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [ACSS Aggregated.workbook](SAP%20%26%20Industry%20Workloads/ACSS%20Aggregated.workbook) | Compute Group | Subscriptions, Help, current_vis, Report_check, vmList, vmNICs, … | 76 | +| [Add monitoring virtual machine (2).workbook](SAP%20%26%20Industry%20Workloads/Add%20monitoring%20virtual%20machine%20%282%29.workbook) | Select virtual machine | MonitoringProfile, MonitoringProfileSub | 21 | +| [Add monitoring virtual machine.workbook](SAP%20%26%20Industry%20Workloads/Add%20monitoring%20virtual%20machine.workbook) | Select virtual machine | MonitoringProfile, MonitoringProfileSub | 15 | +| [Alerts (2).workbook](SAP%20%26%20Industry%20Workloads/Alerts%20%282%29.workbook) | Want to view these across all provider types? | AmsResource, Workspace, ProviderType, Subscription, TimeRange, AlertTemplates | 14 | +| [Alerts (3).workbook](SAP%20%26%20Industry%20Workloads/Alerts%20%283%29.workbook) | Alert templates and the rules based on them are scoped to the monitoring data from the Mo… | MonitoringProfile, Workspaces, TimeRange, Subscription, AlertTemplates, AlertTemp, … | 12 | +| [Alerts.workbook](SAP%20%26%20Industry%20Workloads/Alerts.workbook) | Alerts | AmsResource, Workspace, ProviderType, Subscription, TimeRange, AlertTemplates | 12 | +| [ApplicationPerformance.workbook](SAP%20%26%20Industry%20Workloads/ApplicationPerformance.workbook) | It may take up to 15 minutes for the initial telemetry information to be available for re… | — | 73 | +| [ApplicationServerInsights (2).workbook](SAP%20%26%20Industry%20Workloads/ApplicationServerInsights%20%282%29.workbook) | ApplicationServerInsights (2) | param_check_table_exists, param_ams_resource, param_provider_type, param_providers_list, param_check_error, param_alert_templates | 5 | +| [ApplicationServerInsights (3).workbook](SAP%20%26%20Industry%20Workloads/ApplicationServerInsights%20%283%29.workbook) | {paramrcaavailabilitystate}: Root Cause Analysis (RCA) - {paramrcatitle} Root Cause {para… | param_check_table_exists | 18 | +| [ApplicationServerInsights.workbook](SAP%20%26%20Industry%20Workloads/ApplicationServerInsights.workbook) | {paramrcaavailabilitystate}: Root Cause Analysis (RCA) - {paramrcatitle} Root Cause {para… | param_check_table_exists | 18 | +| [Auto Perf RCA.workbook](SAP%20%26%20Industry%20Workloads/Auto%20Perf%20RCA.workbook) | Insights: {ConstituentInsights} | AMSResource, Workspace, SID, AlertFired, AlertTemplate, scopes, … | 162 | +| [Auto RCA.workbook](SAP%20%26%20Industry%20Workloads/Auto%20RCA.workbook) | Properties | AMSResource, Workspace, hidden | 46 | +| [Availability group.workbook](SAP%20%26%20Industry%20Workloads/Availability%20group.workbook) | Availability group | DatabaseId, TimeRange, WorkspaceId, Computer, AvailabilityGroupId, Workspace, … | 9 | +| [Availability groups.workbook](SAP%20%26%20Industry%20Workloads/Availability%20groups.workbook) | Please select an existing SQL monitoring profile or create a new one using the Create new… | MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, SqlType, … | 9 | +| [AvailabilityTab (2).workbook](SAP%20%26%20Industry%20Workloads/AvailabilityTab%20%282%29.workbook) | Updated every 60 seconds. | — | 5 | +| [AvailabilityTab.workbook](SAP%20%26%20Industry%20Workloads/AvailabilityTab.workbook) | Updated every 2 minutes. | — | 8 | +| [Azure SQL Database.workbook](SAP%20%26%20Industry%20Workloads/Azure%20SQL%20Database.workbook) | {SqlDatabase} | DatabaseId, TimeRange, WorkspaceId, Computer, SqlInstance, SqlDatabase, … | 31 | +| [Azure SQL Databases.workbook](SAP%20%26%20Industry%20Workloads/Azure%20SQL%20Databases.workbook) | Please select an existing SQL monitoring profile or create a new one using the Create new… | MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, SqlType, … | 27 | +| [Azure SQL Managed Instance.workbook](SAP%20%26%20Industry%20Workloads/Azure%20SQL%20Managed%20Instance.workbook) | {SqlInstance} | DatabaseId, TimeRange, WorkspaceId, Computer, SqlInstance, SqlDatabase, … | 30 | +| [Azure SQL Managed Instances.workbook](SAP%20%26%20Industry%20Workloads/Azure%20SQL%20Managed%20Instances.workbook) | Please select an existing SQL monitoring profile or create a new one using the Create new… | MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, SqlType, … | 28 | +| [CapacityPredictionTab.workbook](SAP%20%26%20Industry%20Workloads/CapacityPredictionTab.workbook) | Columnar data will reach chosen limit in {paramcsdaysfromnow} days, on {paramcsfulldate} | — | 10 | +| [Collection logs.workbook](SAP%20%26%20Industry%20Workloads/Collection%20logs.workbook) | Collection logs from {OnboardedComputers} | VirtualMachine, MonitoringProfile, Associations, Workspaces, OnboardedComputers, TimeRange, … | 6 | +| [Create Alert rule (step 1 of 2) (2).workbook](SAP%20%26%20Industry%20Workloads/Create%20Alert%20rule%20%28step%201%20of%202%29%20%282%29.workbook) | {AlertName} | AmsResource, Workspace, ProviderType, Location, ResourceGroup, AlertName, … | 25 | +| [Create Alert rule (step 1 of 2) (3).workbook](SAP%20%26%20Industry%20Workloads/Create%20Alert%20rule%20%28step%201%20of%202%29%20%283%29.workbook) | {AlertName} | MonitoringProfile, Workspaces, Location, ResourceGroup, AlertName, AlertTemplates, … | 14 | +| [Create Alert rule (step 1 of 2).workbook](SAP%20%26%20Industry%20Workloads/Create%20Alert%20rule%20%28step%201%20of%202%29.workbook) | {AlertName} | AmsResource, Workspace, ProviderType, Location, ResourceGroup, AlertName, … | 20 | +| [Create new profile (2).workbook](SAP%20%26%20Industry%20Workloads/Create%20new%20profile%20%282%29.workbook) | Enable SQL monitoring | MonitoringProfileSub, ProfileSubscription, ProfileResourceGroup, ProfileName, InsightTag, DestinationName, … | 17 | +| [Create new profile.workbook](SAP%20%26%20Industry%20Workloads/Create%20new%20profile.workbook) | Enable custom telegraf monitoring | MonitoringProfileSub, ProfileSubscription, ProfileResourceGroup, ProfileName, ProfileLocation, InsightTag, … | 13 | +| [Custom Telegraf Insights.workbook](SAP%20%26%20Industry%20Workloads/Custom%20Telegraf%20Insights.workbook) | Please select an existing custom telegraf monitoring profile or create a new one using th… | MonitoringProfileSub, MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, … | 9 | +| [Database IO.workbook](SAP%20%26%20Industry%20Workloads/Database%20IO.workbook) | {DisplayName} | DatabaseId, WorkspaceId, Computer, SqlInstance, SqlDatabase, Workspace, … | 20 | +| [Database replica details.workbook](SAP%20%26%20Industry%20Workloads/Database%20replica%20details.workbook) | Database: {SqlDatabase} Role: {Role} | DatabaseId, TimeRange, WorkspaceId, Computer, SqlInstance, SqlDatabase, … | 8 | +| [Database space.workbook](SAP%20%26%20Industry%20Workloads/Database%20space.workbook) | {DisplayName} | DatabaseId, WorkspaceId, Computer, SqlInstance, SqlDatabase, Workspace, … | 11 | +| [Db2.workbook](SAP%20%26%20Industry%20Workloads/Db2.workbook) | No active IBM DB2 provider found. | — | 34 | +| [Edit profile.workbook](SAP%20%26%20Industry%20Workloads/Edit%20profile.workbook) | 1. Set destination | MonitoringProfileSub, MonitoringProfile, ProfileSubscription, ProfileName, ProfileLocation, ProfileResourceGroup, … | 10 | +| [Enable monitoring.workbook](SAP%20%26%20Industry%20Workloads/Enable%20monitoring.workbook) | One or more VMs have an outdated version of the WLI extension. | MonitoringProfileSub, MonitoringProfile, Associations, ResourceGroup, Workspaces, CommonErrors | 10 | +| [EnqueueStatistics.workbook](SAP%20%26%20Industry%20Workloads/EnqueueStatistics.workbook) | Enqueue Lock Statistics | — | 11 | +| [Free space in tempdb.workbook](SAP%20%26%20Industry%20Workloads/Free%20space%20in%20tempdb.workbook) | {DisplayName} | DatabaseId, WorkspaceId, Computer, SqlInstance, SqlDatabase, Workspace, … | 7 | +| [Insights - Auto RCA.workbook](SAP%20%26%20Industry%20Workloads/Insights%20-%20Auto%20RCA.workbook) |  Select an unavailability event to view details below. | TimeRange, SID, ApplicationServer, param_check_displaymessage | 5 | +| [Inventory Checks for SAP.workbook](SAP%20%26%20Industry%20Workloads/Inventory%20Checks%20for%20SAP.workbook) | Overview Group | Subscriptions, Dashboard, Location, Expand_Summary | 246 | +| [Memory broker clerk.workbook](SAP%20%26%20Industry%20Workloads/Memory%20broker%20clerk.workbook) | {DisplayName} | DatabaseId, WorkspaceId, Computer, SqlInstance, SqlDatabase, Workspace, … | 7 | +| [MsSqlServer (2).workbook](SAP%20%26%20Industry%20Workloads/MsSqlServer%20%282%29.workbook) | No active Microsoft SQL Server provider found. | — | 37 | +| [MsSqlServer.workbook](SAP%20%26%20Industry%20Workloads/MsSqlServer.workbook) | Azure Monitor for SAP Solutions on MS SQL Server | Days, Provider, Hostname, SQLInstance, WindowsRelease, WindowsSKU, … | 29 | +| [OracleDb.workbook](SAP%20%26%20Industry%20Workloads/OracleDb.workbook) | No active Oracle provider found. | — | 52 | +| [OverviewTab.workbook](SAP%20%26%20Industry%20Workloads/OverviewTab.workbook) | Available Partially Running Not Functional Error Offline Status Updated 5 minutes earlier | — | 12 | +| [PrometheusHaCluster (2).workbook](SAP%20%26%20Industry%20Workloads/PrometheusHaCluster%20%282%29.workbook) | No active High-Availability cluster (Pacemaker) provider found. | param_alert_templates, param_ams_resource, param_provider_type, param_provider_instance, haclusterProviderExist | 28 | +| [PrometheusHaCluster.workbook](SAP%20%26%20Industry%20Workloads/PrometheusHaCluster.workbook) | High-availability cluster status | param_alert_templates, param_provider_type, param_provider_instance | 23 | +| [PrometheusOS (2).workbook](SAP%20%26%20Industry%20Workloads/PrometheusOS%20%282%29.workbook) | No active OS (Linux) provider found. | — | 57 | +| [PrometheusOS.workbook](SAP%20%26%20Industry%20Workloads/PrometheusOS.workbook) | Operating system metrics | — | 51 | +| [QueueStatistics.workbook](SAP%20%26%20Industry%20Workloads/QueueStatistics.workbook) | Updated every 60 seconds. | — | 24 | +| [Replica details.workbook](SAP%20%26%20Industry%20Workloads/Replica%20details.workbook) | Role: {Role} | DatabaseId, TimeRange, WorkspaceId, Computer, SqlInstance, Workspace, … | 8 | +| [SAP AMS.workbook](SAP%20%26%20Industry%20Workloads/SAP%20AMS.workbook) | {alertTitle} | amsResource, workspace, showAdvancedInsights | 66 | +| [SAP Inventory Checks.workbook](SAP%20%26%20Industry%20Workloads/SAP%20Inventory%20Checks.workbook) | Compute Group | Subscriptions, Help, current_vis, Report_check, vmList, vmNICs, … | 76 | +| [SapHana (2).workbook](SAP%20%26%20Industry%20Workloads/SapHana%20%282%29.workbook) | No active SAP HANA provider found. | — | 28 | +| [SapHana.workbook](SAP%20%26%20Industry%20Workloads/SapHana.workbook) | Selection details | param_sizedatasource, param_diskdatasource, param_loadsource | 76 | +| [SapLandscapeMonitor.workbook](SAP%20%26%20Industry%20Workloads/SapLandscapeMonitor.workbook) | You have no fired alerts. | TimeRange, AmsResource, Workspace, Subscription, ProvidersList, Config, … | 14 | +| [SapNetWeaver (2).workbook](SAP%20%26%20Industry%20Workloads/SapNetWeaver%20%282%29.workbook) | No active SAP Netweaver provider found. | param_check_table_exists, param_check_error, param_ams_resource, param_providers_list, param_provider_type, param_alert_templates, … | 36 | +| [SapNetWeaver.workbook](SAP%20%26%20Industry%20Workloads/SapNetWeaver.workbook) | Azure Monitor for SAP Solutions on SAP NetWeaver | param_check_table_exists, param_check_error, param_ams_resource, param_providers_list, param_provider_type, param_alert_templates, … | 174 | +| [SidLandscapeView.workbook](SAP%20%26%20Industry%20Workloads/SidLandscapeView.workbook) | The workbook is loading. | SviResource, AmsResource, Workspace, Subscription | 41 | +| [SQL Server Insights.workbook](SAP%20%26%20Industry%20Workloads/SQL%20Server%20Insights.workbook) | SQL Insights (preview) has been retired on 31 December 2024. | MonitoringProfileSub, MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, … | 14 | +| [SQL Server.workbook](SAP%20%26%20Industry%20Workloads/SQL%20Server.workbook) | {SqlInstance} | DatabaseId, TimeRange, WorkspaceId, Computer, SqlInstance, SqlDatabase, … | 34 | +| [SQL Servers.workbook](SAP%20%26%20Industry%20Workloads/SQL%20Servers.workbook) | Please select an existing SQL monitoring profile or create a new one using the Create new… | MonitoringProfile, Associations, Workspaces, TimeRange, OnboardedComputers, SqlType, … | 28 | +| [SystemCheckTab.workbook](SAP%20%26%20Industry%20Workloads/SystemCheckTab.workbook) | There is no data for backup catalog to display. | — | 50 | +| [SystemOverviewTab.workbook](SAP%20%26%20Industry%20Workloads/SystemOverviewTab.workbook) | SID: {SID} Distributed: {Distributed} Version: {Version} Database: {Database} Licence Sta… | — | 17 | +| [SystemPerformance.workbook](SAP%20%26%20Industry%20Workloads/SystemPerformance.workbook) | Updated every 2 minutes. | — | 16 | +| [SystemUtilizationTab.workbook](SAP%20%26%20Industry%20Workloads/SystemUtilizationTab.workbook) | There is no data for disk fragmentation to display. | — | 9 | +| [Transactions.workbook](SAP%20%26%20Industry%20Workloads/Transactions.workbook) | {DisplayName} | DatabaseId, WorkspaceId, Computer, SqlInstance, SqlDatabase, Workspace, … | 9 | +| [TransactionsTab.workbook](SAP%20%26%20Industry%20Workloads/TransactionsTab.workbook) | There is no data available for Long Idling Cursors. | — | 33 | +| [Troubleshooting details.workbook](SAP%20%26%20Industry%20Workloads/Troubleshooting%20details.workbook) | {Action} | Action, Description, Error | 2 | +| [Update monitoring vm config.workbook](SAP%20%26%20Industry%20Workloads/Update%20monitoring%20vm%20config.workbook) | Update monitoring config : {VirtualMachine:name} | VirtualMachine, MonitoringProfile, ResourceGroup, VmLocation | 19 | +| [WorkbenchTroubleshooting.workbook](SAP%20%26%20Industry%20Workloads/WorkbenchTroubleshooting.workbook) | Azure Blockchain Workbench Logs & Troubleshooting Guide | requestId, timeRange, isRequestNotSuccessful | 10 | +| [WorkloadStatistics.workbook](SAP%20%26%20Industry%20Workloads/WorkloadStatistics.workbook) | Updated every 10 minutes. | — | 18 | + +## Security, Sentinel & Defender + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [Active Alerts.workbook](Security%2C%20Sentinel%20%26%20Defender/Active%20Alerts.workbook) | Active Alerts | Subscription, ResourceIdFilter, AlertDisplayNameFilter, NewAlertFilter | 24 | +| [Active Recommendations.workbook](Security%2C%20Sentinel%20%26%20Defender/Active%20Recommendations.workbook) | Active security recommendations per subscription and cloud environment | subscriptions, severity, environment, info | 8 | +| [Alerts.workbook](Security%2C%20Sentinel%20%26%20Defender/Alerts.workbook) | Microsoft Defender for IoT | — | 8 | +| [API Security.workbook](Security%2C%20Sentinel%20%26%20Defender/API%20Security.workbook) | API Security Dashboard | subscription, severity | 31 | +| [ASC reporting v0.2.2.workbook](Security%2C%20Sentinel%20%26%20Defender/ASC%20reporting%20v0.2.2.workbook) | Azure Security Center (ASC) reporting | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, Help | 56 | +| [ASC reporting v0.2.3a.workbook](Security%2C%20Sentinel%20%26%20Defender/ASC%20reporting%20v0.2.3a.workbook) | Azure Security Center (ASC) reporting | DefaultSubscription_Internal, Subscription, Workspace, TimeRange, Help | 61 | +| [ASC reporting v0.2.4.workbook](Security%2C%20Sentinel%20%26%20Defender/ASC%20reporting%20v0.2.4.workbook) | Azure Security Center (ASC) reporting | Subscription, Workspace, TimeRange, Help | 68 | +| [ASC reporting v0.2.5a.workbook](Security%2C%20Sentinel%20%26%20Defender/ASC%20reporting%20v0.2.5a.workbook) | Azure Security Center (ASC) reporting | Subscription, Workspace, TimeRange, Help | 69 | +| [Attack Paths.workbook](Security%2C%20Sentinel%20%26%20Defender/Attack%20Paths.workbook) | Release notes | Workspace, TimeRange, ErrorHandle, info | 21 | +| [Audit Alert Rules.workbook](Security%2C%20Sentinel%20%26%20Defender/Audit%20Alert%20Rules.workbook) | Help file | Subscription, Workspace, resourceGroup, TimeRange, Help | 8 | +| [Audit Rules vs Incidents.workbook](Security%2C%20Sentinel%20%26%20Defender/Audit%20Rules%20vs%20Incidents.workbook) | sentinel-AuditRulesWorkbook | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, Help | 6 | +| [AWS S3 v0.4.workbook](Security%2C%20Sentinel%20%26%20Defender/AWS%20S3%20v0.4.workbook) | Change Log | Subscription, Workspace, TimeRange, Help | 54 | +| [AWS S3 v0.5 (1).workbook](Security%2C%20Sentinel%20%26%20Defender/AWS%20S3%20v0.5%20%281%29.workbook) | Change Log | Subscription, Workspace, TimeRange, Help | 59 | +| [AWS S3 v0.5.workbook](Security%2C%20Sentinel%20%26%20Defender/AWS%20S3%20v0.5.workbook) | Change Log | Subscription, Workspace, TimeRange, Help | 54 | +| [Azure Monitor Onboarding.workbook](Security%2C%20Sentinel%20%26%20Defender/Azure%20Monitor%20Onboarding.workbook) | {Numerator}{Denominator} Key Vaults Fully Onboarded to Key Vault Insights | Subscriptions, ResourceGroups, Vaults | 6 | +| [Azure Sentinel Central v1-3.workbook](Security%2C%20Sentinel%20%26%20Defender/Azure%20Sentinel%20Central%20v1-3.workbook) | View Azure Sentinel Incidents from all selected Workspaces | iWorkspace, iResourceGroup | 26 | +| [AzureMonitor.workbook](Security%2C%20Sentinel%20%26%20Defender/AzureMonitor.workbook) | Overview section | Subscriptions, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 9 | +| [AzureSecurityAudit.workbook](Security%2C%20Sentinel%20%26%20Defender/AzureSecurityAudit.workbook) | Azure Security reporting | DefaultSubscription_Internal, Subscription | 42 | +| [CIEM Dashboard.workbook](Security%2C%20Sentinel%20%26%20Defender/CIEM%20Dashboard.workbook) | Permissions Management (CIEM) | Subscription, Help | 30 | +| [Compliance.workbook](Security%2C%20Sentinel%20%26%20Defender/Compliance.workbook) | Compliance Over Time | Workspace, Subscription, error | 33 | +| [Containers Security.workbook](Security%2C%20Sentinel%20%26%20Defender/Containers%20Security.workbook) | Containers Security Mapping Dashboard | subscription, acrs, k8sarc, k8sclu, gcpconnector, awsconnectors, … | 98 | +| [CostEstimation.workbook](Security%2C%20Sentinel%20%26%20Defender/CostEstimation.workbook) | Cost estimation workbook | numberofsubscriptions, istenantlevel | 50 | +| [Coverage.workbook](Security%2C%20Sentinel%20%26%20Defender/Coverage.workbook) | Coverage | Subscriptions, info, relativeCoverage, absoluteCoverage, detailedCoverage | 37 | +| [Defender for Cloud reporting v0.2.6.workbook](Security%2C%20Sentinel%20%26%20Defender/Defender%20for%20Cloud%20reporting%20v0.2.6.workbook) | Defender for Cloud reporting | Subscription, Workspace, TimeRange, Help | 69 | +| [DefenderCSPM.workbook](Security%2C%20Sentinel%20%26%20Defender/DefenderCSPM.workbook) | Active Recommendations | subscriptions | 36 | +| [Device risk score.workbook](Security%2C%20Sentinel%20%26%20Defender/Device%20risk%20score.workbook) | The site risk score report provide an overview of your devices status inside your sites a… | Subscription_Id, Site, Zone, Sensor | 12 | +| [Devices.workbook](Security%2C%20Sentinel%20%26%20Defender/Devices.workbook) | Microsoft Defender for IoT | — | 11 | +| [DevOps Security.workbook](Security%2C%20Sentinel%20%26%20Defender/DevOps%20Security.workbook) | DevOps Security | Help | 31 | +| [Firewalls overview v0.1.workbook](Security%2C%20Sentinel%20%26%20Defender/Firewalls%20overview%20v0.1.workbook) | The Summary Rules included in the Solution Package are designed to aggregate log data eff… | TimeRange, Workspace, Help | 96 | +| [Firewalls overview v0.2.workbook](Security%2C%20Sentinel%20%26%20Defender/Firewalls%20overview%20v0.2.workbook) | The Summary Rules included in the Solution Package are designed to aggregate log data eff… | TimeRange, Workspace, Help | 98 | +| [Firewalls overview v0.3.workbook](Security%2C%20Sentinel%20%26%20Defender/Firewalls%20overview%20v0.3.workbook) | The Summary Rules included in the Solution Package are designed to aggregate log data eff… | TimeRange, Workspace, Help | 155 | +| [FortiGate v1.1.workbook](Security%2C%20Sentinel%20%26%20Defender/FortiGate%20v1.1.workbook) | FortiGate overview | Subscription, Workspace, TimeRange, LogSeverity, Action | 22 | +| [Governance.workbook](Security%2C%20Sentinel%20%26%20Defender/Governance.workbook) | Governance | Subscription, RulesCount | 20 | +| [Investigation Insights - v1.7.1.workbook](Security%2C%20Sentinel%20%26%20Defender/Investigation%20Insights%20-%20v1.7.1.workbook) | Investigation Insights | InternalWSs, DefaultSubscription_Internal, Subscription, Workspace, TimeRange, investigateBy, … | 172 | +| [Investigation Insights - v1.7.2.1.workbook](Security%2C%20Sentinel%20%26%20Defender/Investigation%20Insights%20-%20v1.7.2.1.workbook) | Investigation Insights | InternalWSs, DefaultSubscription_Internal, Subscription, Workspace, TimeRange, investigateBy, … | 187 | +| [Investigation Insights - v1.7.2.workbook](Security%2C%20Sentinel%20%26%20Defender/Investigation%20Insights%20-%20v1.7.2.workbook) | Investigation Insights | InternalWSs, DefaultSubscription_Internal, Subscription, Workspace, TimeRange, investigateBy, … | 189 | +| [Investigation Insights - v1.7.3.workbook](Security%2C%20Sentinel%20%26%20Defender/Investigation%20Insights%20-%20v1.7.3.workbook) | Investigation Insights | InternalWSs, DefaultSubscription_Internal, Subscription, Workspace, TimeRange, investigateBy, … | 190 | +| [Investigation Insights - v1.7.workbook](Security%2C%20Sentinel%20%26%20Defender/Investigation%20Insights%20-%20v1.7.workbook) | Investigation Insights | InternalWSs, DefaultSubscription_Internal, Subscription, Workspace, TimeRange, investigateBy, … | 155 | +| [KeyMgmt.workbook](Security%2C%20Sentinel%20%26%20Defender/KeyMgmt.workbook) | Key Management Workbook | TimeRange | 8 | +| [KeyVault.workbook](Security%2C%20Sentinel%20%26%20Defender/KeyVault.workbook) | Azure Key Vaults | DefaultSubscription_Internal, TimeRange, Subscription, Workspaces, KeyVault | 85 | +| [Log4j.workbook](Security%2C%20Sentinel%20%26%20Defender/Log4j.workbook) | Log4j Vulnerability | Subscription | 10 | +| [MITREATTCKFrameworkReferenceforAzureSentinel.workbook](Security%2C%20Sentinel%20%26%20Defender/MITREATTCKFrameworkReferenceforAzureSentinel.workbook) | MITRE ATT&CK Framework Reference for Azure Sentinel | — | 2 | +| [NSP Access Logs Insights.workbook](Security%2C%20Sentinel%20%26%20Defender/NSP%20Access%20Logs%20Insights.workbook) | NSP Access Logs Insights | FilterResource, TimeRange | 2 | +| [Overview.workbook](Security%2C%20Sentinel%20%26%20Defender/Overview.workbook) | ⚠️ Either there are no operations selected or there is no Key Vault log data for this res… | TimeRange, Subscriptions, ResourceGroups, Resource | 21 | +| [parserperformance.workbook](Security%2C%20Sentinel%20%26%20Defender/parserperformance.workbook) | sentinel-UserWorkbook | TimeRange | 77 | +| [PotentialMaliciousEventsMap.workbook](Security%2C%20Sentinel%20%26%20Defender/PotentialMaliciousEventsMap.workbook) | New workbook | — | 2 | +| [QC - Data Connector (1).workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20-%20Data%20Connector%20%281%29.workbook) | ----------------------------------------------------------- | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, Help | 9 | +| [QC Sentinel Central v2.1.6 (1).workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20Sentinel%20Central%20v2.1.6%20%281%29.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 87 | +| [QC Sentinel Central v2.1.6.workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20Sentinel%20Central%20v2.1.6.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 87 | +| [QC Sentinel Central v2.1.7.workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20Sentinel%20Central%20v2.1.7.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 87 | +| [QC Sentinel Central v2.1.8 (1).workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20Sentinel%20Central%20v2.1.8%20%281%29.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 101 | +| [QC Sentinel Central v2.1.8.workbook](Security%2C%20Sentinel%20%26%20Defender/QC%20Sentinel%20Central%20v2.1.8.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 101 | +| [Ransomware.workbook](Security%2C%20Sentinel%20%26%20Defender/Ransomware.workbook) | Ransomware Dashboard Based on MITRE ATT&CK® Framework | — | 20 | +| [SecureScore.workbook](Security%2C%20Sentinel%20%26%20Defender/SecureScore.workbook) | Secure Score Over Time | Workspace, TimeRange, ErrorHandle | 28 | +| [Sensor health.workbook](Security%2C%20Sentinel%20%26%20Defender/Sensor%20health.workbook) | Microsoft Defender for IoT | — | 7 | +| [Sentinel Central v1.6c.workbook](Security%2C%20Sentinel%20%26%20Defender/Sentinel%20Central%20v1.6c.workbook) | View Azure Sentinel Incidents and details from any selected Workspaces | — | 46 | +| [Sentinel Central v1.6d.workbook](Security%2C%20Sentinel%20%26%20Defender/Sentinel%20Central%20v1.6d.workbook) | View Azure Sentinel Incidents and details from any selected Workspaces | — | 46 | +| [Sentinel Central v1.6e.workbook](Security%2C%20Sentinel%20%26%20Defender/Sentinel%20Central%20v1.6e.workbook) | View Azure Sentinel Incidents and details from any selected Workspaces | — | 47 | +| [Sentinel Central v2.0.workbook](Security%2C%20Sentinel%20%26%20Defender/Sentinel%20Central%20v2.0.workbook) | View Azure Sentinel Incidents and details from any selected Workspaces | — | 47 | +| [Sentinel Central v2.1.4.workbook](Security%2C%20Sentinel%20%26%20Defender/Sentinel%20Central%20v2.1.4.workbook) | View Microsoft Sentinel Incidents and details from any selected Workspaces | — | 86 | +| [SentinelCentral.workbook](Security%2C%20Sentinel%20%26%20Defender/SentinelCentral.workbook) | View Azure Sentinel Incidents and details from any selected Workspaces | — | 31 | +| [SentinelOverview.workbook](Security%2C%20Sentinel%20%26%20Defender/SentinelOverview.workbook) | Ingestion Status | — | 44 | +| [SentinelWorkbooks-master.workbook](Security%2C%20Sentinel%20%26%20Defender/SentinelWorkbooks-master.workbook) | Workspace Health Report | DefaultSubscription_Internal, Subscription, Workspace, resourceGroup, TimeRange, GiBperday, … | 102 | +| [SQLServersonMachinesAMAHelper.workbook](Security%2C%20Sentinel%20%26%20Defender/SQLServersonMachinesAMAHelper.workbook) | SQL Servers on Machines AMA Helper | Subscription | 32 | +| [SystemUpdates.workbook](Security%2C%20Sentinel%20%26%20Defender/SystemUpdates.workbook) | System Updates (Preview) | Subscription, Help | 19 | +| [User And Entity Behavior Analytics Workbook.workbook](Security%2C%20Sentinel%20%26%20Defender/User%20And%20Entity%20Behavior%20Analytics%20Workbook.workbook) | User and Entity Behavior Analytics | TimeRange | 21 | +| [Vulnerabilities (2).workbook](Security%2C%20Sentinel%20%26%20Defender/Vulnerabilities%20%282%29.workbook) | Vulnerabilities | Subscription, Severity, SiteName | 19 | +| [Vulnerabilities.workbook](Security%2C%20Sentinel%20%26%20Defender/Vulnerabilities.workbook) | Vulnerability Assessment Findings | Subscription, Help | 31 | + +## Storage & Backup + +| Workbook | Title | Parameters | Steps | +| --- | --- | --- | ---: | +| [ASR Job History.workbook](Storage%20%26%20Backup/ASR%20Job%20History.workbook) | Workspace details | Subscriptions, Workspaces, ReplicationScenario | 18 | +| [ASR ReplicatedItems.workbook](Storage%20%26%20Backup/ASR%20ReplicatedItems.workbook) | Workspace details | Subscriptions, Workspaces, ReplicationScenario | 16 | +| [AtScale.workbook](Storage%20%26%20Backup/AtScale.workbook) | AtScale | Resource, TimeRange | 12 | +| [Availability.workbook](Storage%20%26%20Backup/Availability.workbook) | The data comes from Storage metrics. | Resource | 9 | +| [Backup Audit Reporting Templates.workbook](Storage%20%26%20Backup/Backup%20Audit%20Reporting%20Templates.workbook) | Reporting templates for BCDR auditing | Subscription, ResourceGroup, SearchItem, RowsPerPage, Page | 12 | +| [Backup Configuration Status.workbook](Storage%20%26%20Backup/Backup%20Configuration%20Status.workbook) | Backup configuration status | DataSourceSubscription, DataSourceLocation, DataSourceResourceGroup, SearchItem, SearchTags, IsBackup | 7 | +| [Backup Explorer.workbook](Storage%20%26%20Backup/Backup%20Explorer.workbook) | Backup Explorer (Virtual Machines) - {Tabname} How to use backup explorer? | Subscriptions, BackupItemHostHash, VMHash | 41 | +| [Backup Instances Shown.workbook](Storage%20%26%20Backup/Backup%20Instances%20Shown.workbook) | Resources shown in this report | — | 1 | +| [Backup Job History.workbook](Storage%20%26%20Backup/Backup%20Job%20History.workbook) | Workspace details | Subscriptions, Workspaces | 12 | +| [Backup Report.workbook](Storage%20%26%20Backup/Backup%20Report.workbook) | Azure Backup now provides a set of customizable reporting templates to help you generate… | Subscriptions, Workspaces, VaultsUsingAzureDiagnostics, AzureStorageCutOffDate | 28 | +| [Backup Schedule and Retention.workbook](Storage%20%26%20Backup/Backup%20Schedule%20and%20Retention.workbook) | Backup schedule and retention | DataSourceSubscription, DataSourceResourceGroup, DataSourceLocation, SearchItem, MinRetention, MaxRetention | 6 | +| [backupitems-tab.workbook](Storage%20%26%20Backup/backupitems-tab.workbook) | The below charts are displayed in {AggregationType} view due to your time range selection. | — | 12 | +| [Blob Storage Classic Metrics.workbook](Storage%20%26%20Backup/Blob%20Storage%20Classic%20Metrics.workbook) | Blob Storage (Classic) Metrics | StorageResources, TimeRange | 29 | +| [Blob Storage Metrics.workbook](Storage%20%26%20Backup/Blob%20Storage%20Metrics.workbook) | Blob Storage Metrics | StorageResources, TimeRange | 31 | +| [Capacity.workbook](Storage%20%26%20Backup/Capacity.workbook) | The data comes from Storage metrics. | Resource | 6 | +| [Changes.workbook](Storage%20%26%20Backup/Changes.workbook) | Changes | Resource | 4 | +| [Classic Storage Account.workbook](Storage%20%26%20Backup/Classic%20Storage%20Account.workbook) | Insights are not supported for Classic Storage Account. Go to Monitoring (classic). | — | 1 | +| [Customize ARG Queries.workbook](Storage%20%26%20Backup/Customize%20ARG%20Queries.workbook) | Customizing a view | ProtectableVMs | 3 | +| [Customize LA Queries.workbook](Storage%20%26%20Backup/Customize%20LA%20Queries.workbook) | Customizing a view | FailedVMBackup | 4 | +| [Export as Excel.workbook](Storage%20%26%20Backup/Export%20as%20Excel.workbook) | Exporting a grid as Excel | — | 1 | +| [Failures.workbook](Storage%20%26%20Backup/Failures.workbook) | If you are seeing a lot of errors, here are two possible next steps to take: | Resource | 19 | +| [File Storage Classic Metrics.workbook](Storage%20%26%20Backup/File%20Storage%20Classic%20Metrics.workbook) | File Storage (Classic) Metrics | StorageResources, TimeRange | 22 | +| [File Storage Metrics.workbook](Storage%20%26%20Backup/File%20Storage%20Metrics.workbook) | File Storage Metrics | StorageResources, TimeRange | 31 | +| [GeoReplicationMetrics.workbook](Storage%20%26%20Backup/GeoReplicationMetrics.workbook) | Geo-replication metrics will be affected by monthly internal maintenance operations. | GeoPrimaryCache, GeoSecondaryCache, TimeRange | 8 | +| [Insights.workbook](Storage%20%26%20Backup/Insights.workbook) | {Message} Azure Cache for Redis | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 9 | +| [jobdistribution-tab.workbook](Storage%20%26%20Backup/jobdistribution-tab.workbook) | Distribution of Jobs in Period by Backup Item | — | 17 | +| [optimize-tab.workbook](Storage%20%26%20Backup/optimize-tab.workbook) | Create a new task | — | 50 | +| [Overview (2).workbook](Storage%20%26%20Backup/Overview%20%282%29.workbook) | Overview section | Subscription, Resources, TimeRange, Message, ResourceName, ResourceImageUrl | 9 | +| [Overview.workbook](Storage%20%26%20Backup/Overview.workbook) | All data provided in this report view are Azure Monitor Metrics for Storage. | Resource, TimeRange | 16 | +| [Performance (2).workbook](Storage%20%26%20Backup/Performance%20%282%29.workbook) | The data comes from Storage metrics. | Resource | 8 | +| [Performance.workbook](Storage%20%26%20Backup/Performance.workbook) | Performance | Resource, TimeRange | 29 | +| [policyadherence-tab.workbook](Storage%20%26%20Backup/policyadherence-tab.workbook) | Count of Backup Instances with atleast one successful backup every day | — | 36 | +| [policydetails-tab.workbook](Storage%20%26%20Backup/policydetails-tab.workbook) | The below charts are displayed in {AggregationType} view due to your time range selection. | — | 17 | +| [Queue Storage Classic Metrics.workbook](Storage%20%26%20Backup/Queue%20Storage%20Classic%20Metrics.workbook) | Queue Storage (Classic) Metrics | StorageResources, TimeRange | 22 | +| [Queue Storage Metrics.workbook](Storage%20%26%20Backup/Queue%20Storage%20Metrics.workbook) | Queue Storage Metrics | StorageResources, TimeRange | 31 | +| [ResourceInsights.workbook](Storage%20%26%20Backup/ResourceInsights.workbook) | ResourceInsights | Resource, TimeRange | 25 | +| [Resources Shown.workbook](Storage%20%26%20Backup/Resources%20Shown.workbook) | Resources shown in this report | — | 2 | +| [Reuse a View.workbook](Storage%20%26%20Backup/Reuse%20a%20View.workbook) | Reusing a view in another workbook | — | 1 | +| [Storage Account Metrics.workbook](Storage%20%26%20Backup/Storage%20Account%20Metrics.workbook) | Storage Account Metrics | StorageResources, TimeRange | 30 | +| [StorageAccounts.workbook](Storage%20%26%20Backup/StorageAccounts.workbook) | Storage Account Workbook | TimeRange, Username | 5 | +| [summary-tab.workbook](Storage%20%26%20Backup/summary-tab.workbook) | Key Parameters by Backup Solution | — | 4 | +| [Table Storage Classic Metrics.workbook](Storage%20%26%20Backup/Table%20Storage%20Classic%20Metrics.workbook) | Table Storage (Classic) Metrics | StorageResources, TimeRange | 22 | +| [Table Storage Metrics.workbook](Storage%20%26%20Backup/Table%20Storage%20Metrics.workbook) | Table Storage Metrics | StorageResources, TimeRange | 31 | +| [Transaction Failures.workbook](Storage%20%26%20Backup/Transaction%20Failures.workbook) | Investigating Transaction Failures | Resource, TimeRange | 10 | +| [Troubleshoot.workbook](Storage%20%26%20Backup/Troubleshoot.workbook) | Troubleshooting issues | — | 1 | +| [usage-tab.workbook](Storage%20%26%20Backup/usage-tab.workbook) | The below charts are displayed in {AggregationType} view due to your time range selection. | — | 13 | +| [User Triggered Operations.workbook](Storage%20%26%20Backup/User%20Triggered%20Operations.workbook) | Workspace details | Subscriptions, Workspaces | 11 | +| [Vaults Shown.workbook](Storage%20%26%20Backup/Vaults%20Shown.workbook) | Resources shown in this report | — | 1 | +| [VMs Shown.workbook](Storage%20%26%20Backup/VMs%20Shown.workbook) | Resources shown in this report | — | 1 | diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..c78bd4b --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,47 @@ +# Contributing + +Thanks for adding to the collection. A pull request only needs a few things +to be mergeable. + +## Adding a workbook + +1. Export the workbook from the Azure portal: open it, choose **Edit**, then + **Advanced Editor** (``), switch to **Gallery Template**, and copy the + JSON. +2. Save it as `/.workbook` in the folder that + fits best. Pick a name that says what the workbook shows; avoid generic + portal names such as `Overview.workbook` or names ending in `(2)`. +3. Remove anything specific to your environment by running + + ```bash + python scripts/scrub_resource_ids.py + ``` + + which swaps subscription IDs, resource groups and workspace names in + `fallbackResourceIds`, `crossComponentResources` and parameter defaults for + neutral placeholders. Check the diff for anything else the script would not + know about, such as tenant names or user principal names in query text. +4. If the template comes from another project, keep its original attribution + in a text step at the top of the workbook and mention the source in the + pull request. +5. Regenerate the catalog and validate: + + ```bash + python scripts/build_catalog.py + python scripts/validate_workbooks.py + ``` + +The same three scripts run in CI on every pull request. They need only a +standard Python 3.9+ installation; there are no third-party dependencies. + +## Changing an existing workbook + +Keep the file valid `Notebook/1.0` JSON, leave the two-space formatting the +portal produces so diffs stay readable, and re-run the catalog script if the +first heading or top-level parameters changed. + +## Reporting problems + +Open an issue that names the workbook file and describes what you expected. +If a template is included without proper credit to its original author, say +so and it will be fixed. diff --git a/Compute & Containers/AzureVMwithDiskspace.workbook b/Compute & Containers/AzureVMwithDiskspace.workbook index 1c87b60..c211cce 100644 --- a/Compute & Containers/AzureVMwithDiskspace.workbook +++ b/Compute & Containers/AzureVMwithDiskspace.workbook @@ -120,7 +120,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/5733bcb3-7fde-4caf-8629-41dc15e3b352" + "/subscriptions/00000000-0000-0000-0000-000000000000" ] }, { @@ -133,7 +133,7 @@ "crossComponentResources": [ "{Subscriptions}" ], - "value": "/subscriptions/5733bcb3-7fde-4caf-8629-41dc15e3b352/resourceGroups/CH-OpsRG-Pri/providers/Microsoft.OperationalInsights/workspaces/CH-LA", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Databases & Data/Azure Data Factory Analytics.workbook b/Databases & Data/Azure Data Factory Analytics.workbook index f085236..3cdf6ee 100644 --- a/Databases & Data/Azure Data Factory Analytics.workbook +++ b/Databases & Data/Azure Data Factory Analytics.workbook @@ -1050,7 +1050,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/0655238a-76cd-4f92-bfe7-ca1a600a8f87/resourceGroups/MonitoringRG/providers/Microsoft.OperationalInsights/workspaces/PrimaryOMS" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" } \ No newline at end of file diff --git a/Endpoint & Intune/Intune-EndpointMgrDeviceIDReference.workbook b/Endpoint & Intune/Intune-EndpointMgrDeviceIDReference.workbook index b0cd65e..366b7f0 100644 --- a/Endpoint & Intune/Intune-EndpointMgrDeviceIDReference.workbook +++ b/Endpoint & Intune/Intune-EndpointMgrDeviceIDReference.workbook @@ -36,7 +36,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/e6799fb8-c1f1-412b-a8d0-e58131aeacbc/resourcegroups/6mdmazuresentinel/providers/microsoft.operationalinsights/workspaces/6mdmazuresentinele" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Endpoint & Intune/IntuneAuditActivity (2).workbook b/Endpoint & Intune/IntuneAuditActivity (2).workbook index 98dea06..728e398 100644 --- a/Endpoint & Intune/IntuneAuditActivity (2).workbook +++ b/Endpoint & Intune/IntuneAuditActivity (2).workbook @@ -304,7 +304,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/e6799fb8-c1f1-412b-a8d0-e58131aeacbc/resourcegroups/6mdmazuresentinel/providers/microsoft.operationalinsights/workspaces/6mdmazuresentinele" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Endpoint & Intune/IntuneComplianceActivity.workbook b/Endpoint & Intune/IntuneComplianceActivity.workbook index df7a4ac..9f14e50 100644 --- a/Endpoint & Intune/IntuneComplianceActivity.workbook +++ b/Endpoint & Intune/IntuneComplianceActivity.workbook @@ -224,7 +224,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/e6799fb8-c1f1-412b-a8d0-e58131aeacbc/resourcegroups/6mdmazuresentinel/providers/microsoft.operationalinsights/workspaces/6mdmazuresentinele" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Endpoint & Intune/IntuneEnrollmentActivity.workbook b/Endpoint & Intune/IntuneEnrollmentActivity.workbook index 9adb88d..87d9639 100644 --- a/Endpoint & Intune/IntuneEnrollmentActivity.workbook +++ b/Endpoint & Intune/IntuneEnrollmentActivity.workbook @@ -327,7 +327,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/e6799fb8-c1f1-412b-a8d0-e58131aeacbc/resourcegroups/6mdmazuresentinel/providers/microsoft.operationalinsights/workspaces/6mdmazuresentinele" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Identity & Access/Provisioning Insights.workbook b/Identity & Access/Provisioning Insights.workbook index 7c9af12..7a359fb 100644 --- a/Identity & Access/Provisioning Insights.workbook +++ b/Identity & Access/Provisioning Insights.workbook @@ -1306,7 +1306,7 @@ "timeContextFromParameter": "TimeRange2", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", - "value": "cgreg@woodgrove.ms" + "value": "user@example.com" } ], "style": "pills", diff --git a/Identity & Access/Sign-Ins Interactive vs Non-Interactive Workbook.workbook b/Identity & Access/Sign-Ins Interactive vs Non-Interactive Workbook.workbook index 687fa20..4fee037 100644 --- a/Identity & Access/Sign-Ins Interactive vs Non-Interactive Workbook.workbook +++ b/Identity & Access/Sign-Ins Interactive vs Non-Interactive Workbook.workbook @@ -685,7 +685,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/ab48f397-fc82-4634-aa52-62dd91b3ebaa/resourcegroups/woodgrove-rg/providers/microsoft.operationalinsights/workspaces/woodgrove-loganalyiticsworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" } \ No newline at end of file diff --git a/Monitoring & Management/AzureCost.workbook b/Monitoring & Management/AzureCost.workbook index f65759d..ec20f21 100644 --- a/Monitoring & Management/AzureCost.workbook +++ b/Monitoring & Management/AzureCost.workbook @@ -38,7 +38,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000" }, { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", @@ -49,7 +49,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourceGroups/RodAzureSentinel/providers/Microsoft.OperationalInsights/workspaces/RodAzureSentinelWorkspace", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/DataConnectorCost.workbook b/Monitoring & Management/DataConnectorCost.workbook index a94ca52..e479e10 100644 --- a/Monitoring & Management/DataConnectorCost.workbook +++ b/Monitoring & Management/DataConnectorCost.workbook @@ -1,12 +1,10 @@ -//A Workbook that shows all tables with data and allows multi-selecting sources to show combined total cost - { "version": "Notebook/1.0", "items": [ { "type": 1, "content": { - "json": "" + "json": "## Data connector cost\n\nA Workbook that shows all tables with data and allows multi-selecting sources to show combined total cost" }, "name": "text - 2" }, @@ -96,7 +94,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourcegroups/rodazuresentinel/providers/microsoft.operationalinsights/workspaces/rodazuresentinelworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Monitoring & Management/DataIngestionLatency.workbook b/Monitoring & Management/DataIngestionLatency.workbook index 77832e9..444a768 100644 --- a/Monitoring & Management/DataIngestionLatency.workbook +++ b/Monitoring & Management/DataIngestionLatency.workbook @@ -94,7 +94,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/e6799fb8-c1f1-412b-a8d0-e58131aeacbc/resourcegroups/6mdmazuresentinel/providers/microsoft.operationalinsights/workspaces/6mdmazuresentinele" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Monitoring & Management/FindComputersMissingInLogs.workbook b/Monitoring & Management/FindComputersMissingInLogs.workbook index f23f199..899de2c 100644 --- a/Monitoring & Management/FindComputersMissingInLogs.workbook +++ b/Monitoring & Management/FindComputersMissingInLogs.workbook @@ -128,7 +128,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382" + "/subscriptions/00000000-0000-0000-0000-000000000000" ] }, { @@ -141,7 +141,7 @@ "crossComponentResources": [ "{Subscriptions}" ], - "value": "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/WaaSUpdateInsights (1).workbook b/Monitoring & Management/WaaSUpdateInsights (1).workbook index b3b1ae9..934e038 100644 --- a/Monitoring & Management/WaaSUpdateInsights (1).workbook +++ b/Monitoring & Management/WaaSUpdateInsights (1).workbook @@ -16,7 +16,7 @@ "quote": "'", "delimiter": ",", "value": [ - "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f" + "/subscriptions/00000000-0000-0000-0000-000000000000" ], "typeSettings": { "additionalResourceOptions": [], @@ -38,7 +38,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "9fa77675-1222-4936-89d0-285da325bba0", diff --git a/Monitoring & Management/Workspace Health Report v1.4.4 -quickFix.workbook b/Monitoring & Management/Workspace Health Report v1.4.4 -quickFix.workbook index 1dda904..de4f752 100644 --- a/Monitoring & Management/Workspace Health Report v1.4.4 -quickFix.workbook +++ b/Monitoring & Management/Workspace Health Report v1.4.4 -quickFix.workbook @@ -91,7 +91,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/soc/providers/microsoft.operationalinsights/workspaces/cybersecuritysoc", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/Workspace Usage Report v1.6.2.workbook b/Monitoring & Management/Workspace Usage Report v1.6.2.workbook index c556d47..42a4fed 100644 --- a/Monitoring & Management/Workspace Usage Report v1.6.2.workbook +++ b/Monitoring & Management/Workspace Usage Report v1.6.2.workbook @@ -39,7 +39,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "label": "☁️ Subscription", - "value": "/subscriptions/2a1051a5-feab-477b-b033-ea6b4634a1b3" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000" }, { "id": "e94aafa3-c5d9-4523-89f0-4e87aa754511", diff --git a/Monitoring & Management/Workspace Usage Report v1.6.4 (1).workbook b/Monitoring & Management/Workspace Usage Report v1.6.4 (1).workbook index f60d0a1..90bc78a 100644 --- a/Monitoring & Management/Workspace Usage Report v1.6.4 (1).workbook +++ b/Monitoring & Management/Workspace Usage Report v1.6.4 (1).workbook @@ -49,7 +49,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourceGroups/QC-PROD-RG/providers/Microsoft.OperationalInsights/workspaces/QC-Prod", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/Workspace Usage Report v1.6.5 (12).workbook b/Monitoring & Management/Workspace Usage Report v1.6.5 (12).workbook index 2116eef..0fbcb8f 100644 --- a/Monitoring & Management/Workspace Usage Report v1.6.5 (12).workbook +++ b/Monitoring & Management/Workspace Usage Report v1.6.5 (12).workbook @@ -52,7 +52,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/2f84d581-f18a-473f-8574-766c505c263d/resourceGroups/SOC-Defense.Fun-QCyber-rg/providers/Microsoft.OperationalInsights/workspaces/Dev-SOC-DefenseFun-QCyber-LA", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/Workspace Usage V1.6.2(Sept2022 beta).workbook b/Monitoring & Management/Workspace Usage V1.6.2(Sept2022 beta).workbook index 72dd6a2..6dea842 100644 --- a/Monitoring & Management/Workspace Usage V1.6.2(Sept2022 beta).workbook +++ b/Monitoring & Management/Workspace Usage V1.6.2(Sept2022 beta).workbook @@ -13245,7 +13245,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/5e303868-677c-4b4f-b2e8-4b288932f6d4/resourcegroups/securityrg/providers/microsoft.operationalinsights/workspaces/securityworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Monitoring & Management/Workspace Usage report v1.2.workbook b/Monitoring & Management/Workspace Usage report v1.2.workbook index c575226..2a34a2a 100644 --- a/Monitoring & Management/Workspace Usage report v1.2.workbook +++ b/Monitoring & Management/Workspace Usage report v1.2.workbook @@ -94,7 +94,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/Workspace Usage report.workbook b/Monitoring & Management/Workspace Usage report.workbook index 24736c3..6536b8d 100644 --- a/Monitoring & Management/Workspace Usage report.workbook +++ b/Monitoring & Management/Workspace Usage report.workbook @@ -94,7 +94,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/44e4eff8-1fcb-4a22-a7d6-992ac7286382/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecurityDemo", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true diff --git a/Monitoring & Management/_api test v1.4.6 (1).workbook b/Monitoring & Management/_api test v1.4.6 (1).workbook index c3f321d..9d8a26b 100644 --- a/Monitoring & Management/_api test v1.4.6 (1).workbook +++ b/Monitoring & Management/_api test v1.4.6 (1).workbook @@ -26,7 +26,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Monitoring & Management/findComputersMissingInLogs v0.1.workbook b/Monitoring & Management/findComputersMissingInLogs v0.1.workbook index 717d6a2..c131175 100644 --- a/Monitoring & Management/findComputersMissingInLogs v0.1.workbook +++ b/Monitoring & Management/findComputersMissingInLogs v0.1.workbook @@ -105,7 +105,7 @@ "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ - "/subscriptions/5e303868-677c-4b4f-b2e8-4b288932f6d4/resourcegroups/securityrg/providers/microsoft.operationalinsights/workspaces/securityworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "parameters": [ { diff --git a/Monitoring & Management/findComputersMissingInLogs v0.2.workbook b/Monitoring & Management/findComputersMissingInLogs v0.2.workbook index 2fa3c3c..2c3844e 100644 --- a/Monitoring & Management/findComputersMissingInLogs v0.2.workbook +++ b/Monitoring & Management/findComputersMissingInLogs v0.2.workbook @@ -124,7 +124,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2" + "/subscriptions/00000000-0000-0000-0000-000000000000" ] }, { diff --git a/Networking/PublicIP v0.1.workbook b/Networking/PublicIP v0.1.workbook index aa94978..13addab 100644 --- a/Networking/PublicIP v0.1.workbook +++ b/Networking/PublicIP v0.1.workbook @@ -36,7 +36,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "9fa77675-1222-4936-89d0-285da325bba0", diff --git a/Networking/PublicIP v0.2.3release.workbook b/Networking/PublicIP v0.2.3release.workbook index 433caf5..3a38e96 100644 --- a/Networking/PublicIP v0.2.3release.workbook +++ b/Networking/PublicIP v0.2.3release.workbook @@ -36,7 +36,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/7b76bfbc-cb1e-4df1-b6e8-b826eef6c592/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "86b1f0f2-a800-4330-9573-44dcb7f765fe", diff --git a/Networking/User Map V1.4c.workbook b/Networking/User Map V1.4c.workbook index c1c7cf6..2d19612 100644 --- a/Networking/User Map V1.4c.workbook +++ b/Networking/User Map V1.4c.workbook @@ -403,7 +403,7 @@ "type": 6, "description": "Alternate Subscription/Workspace if the watchlist is centrally stored", "isRequired": true, - "value": "/subscriptions/5e303868-677c-4b4f-b2e8-4b288932f6d4", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000", "typeSettings": { "additionalResourceOptions": [], "includeAll": false, @@ -424,7 +424,7 @@ "crossComponentResources": [ "{watchlistSubscription}" ], - "value": "/subscriptions/5e303868-677c-4b4f-b2e8-4b288932f6d4/resourceGroups/securityRG/providers/Microsoft.OperationalInsights/workspaces/securityWorkspace", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Networking/UserMap.workbook b/Networking/UserMap.workbook index 616b2cc..923e1c9 100644 --- a/Networking/UserMap.workbook +++ b/Networking/UserMap.workbook @@ -12,7 +12,7 @@ "name": "Subscription", "type": 6, "isRequired": true, - "value": "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000", "typeSettings": { "additionalResourceOptions": [], "includeAll": false @@ -36,7 +36,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourceGroups/RodAzureSentinel/providers/Microsoft.OperationalInsights/workspaces/RodAzureSentinelWorkspace" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" }, { "id": "c4b69c01-2263-4ada-8d9c-43433b739ff3", @@ -2207,7 +2207,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourcegroups/rodazuresentinel/providers/microsoft.operationalinsights/workspaces/rodazuresentinelworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Networking/VNet.workbook b/Networking/VNet.workbook index f09c8a9..068b672 100644 --- a/Networking/VNet.workbook +++ b/Networking/VNet.workbook @@ -6,7 +6,7 @@ "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379" + "/subscriptions/00000000-0000-0000-0000-000000000000" ], "parameters": [ { @@ -58,7 +58,7 @@ "delimiter": ",", "query": "Resources\r\n| where type=~ \"microsoft.network/networkwatchers/flowlogs\"\r\n| where properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.enabled == true\r\n| project wsResourceId = tolower(properties.flowAnalyticsConfiguration.networkWatcherFlowAnalyticsConfiguration.workspaceResourceId)\r\n| distinct wsResourceId\r\n| project wsResourceId, wsName = wsResourceId//tolower(split(wsResourceId, '/')[8])\r\n", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379" + "/subscriptions/00000000-0000-0000-0000-000000000000" ], "typeSettings": { "additionalResourceOptions": [], @@ -70,7 +70,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourcegroups/defaultresourcegroup-eus/providers/microsoft.operationalinsights/workspaces/defaultworkspace-af15e575-f948-49ac-bce0-252d028e9379-eus" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ] }, { @@ -683,10 +683,10 @@ "content": { "version": "KqlParameterItem/1.0", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala-vnet", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala1", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisatestlaw", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-vnetfl/providers/Microsoft.OperationalInsights/workspaces/srisa-vnetfl-la" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "parameters": [ { @@ -702,10 +702,10 @@ "delimiter": ",", "query": "{SubscriptionQueryToRun}", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala-vnet", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala1", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisatestlaw", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-vnetfl/providers/Microsoft.OperationalInsights/workspaces/srisa-vnetfl-la" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "typeSettings": { "additionalResourceOptions": [ @@ -721,7 +721,7 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": [ - "af15e575-f948-49ac-bce0-252d028e9379" + "00000000-0000-0000-0000-000000000000" ] }, { @@ -761,10 +761,10 @@ "delimiter": ",", "query": "{SubscriptionQueryToRun}", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala-vnet", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala1", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisatestlaw", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-vnetfl/providers/Microsoft.OperationalInsights/workspaces/srisa-vnetfl-la" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "typeSettings": { "additionalResourceOptions": [], @@ -785,10 +785,10 @@ "isRequired": true, "query": "let value = replace_string(\"{SubList}\",\"'\",'\"');\r\nprint value", "crossComponentResources": [ - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala-vnet", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisala1", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-rg1/providers/Microsoft.OperationalInsights/workspaces/srisatestlaw", - "/subscriptions/af15e575-f948-49ac-bce0-252d028e9379/resourceGroups/srisa-vnetfl/providers/Microsoft.OperationalInsights/workspaces/srisa-vnetfl-la" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "timeContext": { "durationMs": 2592000000 diff --git a/README.md b/README.md index 69dc82b..9eb6f32 100644 --- a/README.md +++ b/README.md @@ -1,78 +1,106 @@ # Azure Monitor Workbook Templates -A curated collection of **Azure Monitor Workbook templates** — gathered and -authored to make it easier to visualize, troubleshoot, and report on Azure -resources, logs, and metrics. - -## Purpose - -This repository serves as a central place to host a collection of Azure -Workbook templates. The templates here come from two sources: - -- **Templates created by the repository owner** for real-world monitoring, - reporting, and operational scenarios. -- **Templates sourced from other open source repositories**, included here to - build a single, convenient reference library. Where a template originates - from another project, attribution to the original source is preserved. - -The goal is to provide a reusable, ready-to-deploy set of workbooks that can be -imported directly into Azure Monitor. +A curated library of **Azure Monitor Workbook templates**: 824 ready-to-import +workbooks across 14 categories, gathered from Microsoft's product galleries, +community projects and the repository owner's own work, so that a useful +template is one copy-and-paste away. + +Browse the full list, with a derived title and the parameters each template +expects, in **[CATALOG.md](CATALOG.md)**. + +## Categories + +| Folder | Workbooks | Covers | +| --- | ---: | --- | +| [AI & Machine Learning](AI%20%26%20Machine%20Learning) | 10 | Azure AI Foundry, OpenAI and Cognitive Services, Copilot Studio, experimentation, video analytics | +| [Application Insights & APM](Application%20Insights%20%26%20APM) | 37 | Usage, retention, funnels, HEART analytics, failures, performance and SDK analysis for Application Insights | +| [Authoring, Templates & Examples](Authoring%2C%20Templates%20%26%20Examples) | 31 | Layout patterns, tabs and groups, API demos, KQL syntax helpers, starter templates | +| [Compute & Containers](Compute%20%26%20Containers) | 106 | VM Insights, VM performance, AKS and Container Insights, Azure Local (HCI), Azure Virtual Desktop, HDInsight | +| [Databases & Data](Databases%20%26%20Data) | 105 | Azure SQL and SQL Managed Instance, PostgreSQL, Cosmos DB (including Cassandra and Mongo), Data Explorer, Data Factory, Spark | +| [Endpoint & Intune](Endpoint%20%26%20Intune) | 11 | Intune devices, compliance, enrollment and audit activity, Defender for Endpoint | +| [Identity & Access](Identity%20%26%20Access) | 45 | Microsoft Entra sign-ins, Conditional Access, MFA, provisioning, entitlement management, risk | +| [Integration & Messaging](Integration%20%26%20Messaging) | 33 | Logic Apps, Integration Environments, API Management, Service Bus, Azure Communication Services | +| [IoT](IoT) | 8 | IoT Edge fleet views, device details and health snapshots, platform message counts | +| [Monitoring & Management](Monitoring%20%26%20Management) | 184 | Log Analytics workspace usage and health, agents and DCRs, alerts, Update Manager, cost, assessments | +| [Networking](Networking) | 67 | Traffic analytics and NSG flow logs, VNet, VPN and ExpressRoute gateways, Application Gateway, Azure Firewall, Load Balancer, NAT Gateway, Private Link | +| [SAP & Industry Workloads](SAP%20%26%20Industry%20Workloads) | 70 | Azure Monitor for SAP solutions (NetWeaver, HANA, Db2, Oracle, SQL Server), SAP landscape views | +| [Security, Sentinel & Defender](Security%2C%20Sentinel%20%26%20Defender) | 68 | Microsoft Sentinel central and investigation workbooks, Defender for Cloud, MITRE ATT&CK, connectors | +| [Storage & Backup](Storage%20%26%20Backup) | 49 | Storage account, blob, file, queue and table metrics, Backup reports and Backup Explorer, Site Recovery jobs | + +Each folder holds flat `*.workbook` files. A `.workbook` file is the JSON a +workbook exports as from the portal's Advanced Editor (`"version": +"Notebook/1.0"`) and can be pasted straight back in. + +Several files share a base name with a numeric suffix, for example +`Cluster (3).workbook`. These are **different templates** that happened to be +exported under the same generic name, not copies; the catalog's title and +parameter columns tell them apart. ## What is an Azure Workbook? [Azure Workbooks](https://learn.microsoft.com/azure/azure-monitor/visualize/workbooks-overview) -provide a flexible canvas for data analysis and the creation of rich visual -reports within the Azure portal. They let you combine text, log queries -(KQL), metrics, and parameters into interactive, shareable reports. - -## Repository Structure - -Each folder in this repository contains one or more related workbook -templates, typically stored as Azure Resource Manager (ARM) / Gallery -Template JSON files (`.json`) that can be imported into Azure Monitor. +provide a flexible canvas for data analysis and rich visual reports inside the +Azure portal. They combine text, log queries (KQL), metrics, Azure Resource +Graph, alerts and parameters into interactive, shareable reports. + +## How to use a template + +1. Open the [Azure portal](https://portal.azure.com) and go to + **Monitor → Workbooks**, or the **Workbooks** blade of a specific resource + such as a Log Analytics workspace, Application Insights component or + Sentinel workspace. Opening the workbook from the resource it targets means + its parameters resolve to that resource automatically. +2. Select **New**, then open the **Advanced Editor** (the `` button). +3. Keep the editor on **Gallery Template**. +4. Paste the contents of the `.workbook` file from this repository and select + **Apply**. +5. Choose values for the parameters at the top (subscription, workspace, time + range and so on), then **Save** the workbook into your own subscription. + +Templates in this repository contain no environment-specific resource IDs. +Where a workbook needs a default resource, it carries a placeholder such as +`/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/...`; +the portal simply treats it as an unselected resource until you pick your own. + +For more detail see Microsoft's guide to +[creating and importing workbook templates](https://learn.microsoft.com/azure/azure-monitor/visualize/workbooks-templates). -``` -. -├── / -│ └── .json -├── ... -└── README.md -``` +## Repository tooling -## How to Use a Template +Three dependency-free Python scripts keep the collection healthy. They run in +GitHub Actions on every pull request. -1. Open the [Azure portal](https://portal.azure.com) and navigate to - **Azure Monitor → Workbooks** (or the Workbooks blade of a specific - resource). -2. Create a **New** workbook, then open the **Advanced Editor** (the `` - icon). -3. Set the editor to **Gallery Template** mode. -4. Copy the contents of the desired `.json` template from this repository and - paste it into the editor. -5. Click **Apply** to load the workbook, then **Save** it to your own - subscription. +| Script | Purpose | +| --- | --- | +| `scripts/validate_workbooks.py` | Confirms every file is valid `Notebook/1.0` JSON and contains no leaked subscription-scoped resource IDs | +| `scripts/scrub_resource_ids.py` | Replaces real subscription, resource group and workspace identifiers with neutral placeholders (`--check` reports without writing) | +| `scripts/build_catalog.py` | Regenerates [CATALOG.md](CATALOG.md) from the workbook contents (`--check` fails when the catalog is stale) | -For more detail, see the official guide on -[creating and importing workbook templates](https://learn.microsoft.com/azure/azure-monitor/visualize/workbooks-templates). +```bash +python scripts/scrub_resource_ids.py +python scripts/build_catalog.py +python scripts/validate_workbooks.py +``` ## Contributing -Contributions are welcome. If you have a workbook template you'd like to -share: - -1. Fork the repository. -2. Add your template to an appropriately named folder. -3. Include a short description and, if the template is derived from another - project, attribution to the original source. -4. Open a pull request. +Contributions are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for the +short checklist: pick a descriptive file name, scrub environment identifiers, +keep attribution for templates that come from elsewhere, and regenerate the +catalog. ## Attribution -Some templates in this repository originate from other open source projects. -Credit and links to the original sources are retained alongside the relevant -templates. If you believe a template has been included without proper +Many templates originate from Microsoft product galleries and other open +source projects, including the +[Application Insights Workbooks](https://github.com/microsoft/Application-Insights-Workbooks) +gallery and the [Microsoft Sentinel](https://github.com/Azure/Azure-Sentinel) +repository. Credit and links to original sources are kept inside the relevant +workbooks. If you believe a template has been included without proper attribution, please open an issue. ## License This project is licensed under the terms of the [MIT License](LICENSE). +Templates sourced from other projects remain subject to their original +licenses. diff --git a/Security, Sentinel & Defender/ASC reporting v0.2.2.workbook b/Security, Sentinel & Defender/ASC reporting v0.2.2.workbook index 93bb191..6abbf47 100644 --- a/Security, Sentinel & Defender/ASC reporting v0.2.2.workbook +++ b/Security, Sentinel & Defender/ASC reporting v0.2.2.workbook @@ -45,7 +45,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/82931e73-05c6-4da8-a666-bc4a7dd1bd3e" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000" }, { "id": "60aefb4f-887d-4203-81d9-2199f1f6b9dd", diff --git a/Security, Sentinel & Defender/ASC reporting v0.2.4.workbook b/Security, Sentinel & Defender/ASC reporting v0.2.4.workbook index d03ac0f..bd8fc54 100644 --- a/Security, Sentinel & Defender/ASC reporting v0.2.4.workbook +++ b/Security, Sentinel & Defender/ASC reporting v0.2.4.workbook @@ -2537,7 +2537,7 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ - "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "gridSettings": { "formatters": [ diff --git a/Security, Sentinel & Defender/ASC reporting v0.2.5a.workbook b/Security, Sentinel & Defender/ASC reporting v0.2.5a.workbook index 58a1348..f995284 100644 --- a/Security, Sentinel & Defender/ASC reporting v0.2.5a.workbook +++ b/Security, Sentinel & Defender/ASC reporting v0.2.5a.workbook @@ -2570,7 +2570,7 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ - "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "gridSettings": { "formatters": [ diff --git a/Security, Sentinel & Defender/Azure Sentinel Central v1-3.workbook b/Security, Sentinel & Defender/Azure Sentinel Central v1-3.workbook index ef94185..7609fbb 100644 --- a/Security, Sentinel & Defender/Azure Sentinel Central v1-3.workbook +++ b/Security, Sentinel & Defender/Azure Sentinel Central v1-3.workbook @@ -1263,11 +1263,11 @@ ], "defaultResourceIds": [ "Azure Monitor", - "/subscriptions/82931e73-05c6-4da8-a666-bc4a7dd1bd3e/resourceGroups/fabrikamltdprodrg/providers/Microsoft.OperationalInsights/workspaces/fabrikamltdprod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "fallbackResourceIds": [ "Azure Monitor", - "/subscriptions/82931e73-05c6-4da8-a666-bc4a7dd1bd3e/resourceGroups/fabrikamltdprodrg/providers/Microsoft.OperationalInsights/workspaces/fabrikamltdprod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" } \ No newline at end of file diff --git a/Security, Sentinel & Defender/Defender for Cloud reporting v0.2.6.workbook b/Security, Sentinel & Defender/Defender for Cloud reporting v0.2.6.workbook index 5d5651d..e05ddaa 100644 --- a/Security, Sentinel & Defender/Defender for Cloud reporting v0.2.6.workbook +++ b/Security, Sentinel & Defender/Defender for Cloud reporting v0.2.6.workbook @@ -2567,7 +2567,7 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "crossComponentResources": [ - "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/soc/providers/Microsoft.OperationalInsights/workspaces/cybersecuritysoc" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ], "gridSettings": { "formatters": [ diff --git a/Security, Sentinel & Defender/Firewalls overview v0.1.workbook b/Security, Sentinel & Defender/Firewalls overview v0.1.workbook index bddbadb..033fd72 100644 --- a/Security, Sentinel & Defender/Firewalls overview v0.1.workbook +++ b/Security, Sentinel & Defender/Firewalls overview v0.1.workbook @@ -3388,7 +3388,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-PaloAltoOverview", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/Governance.workbook b/Security, Sentinel & Defender/Governance.workbook index 8defa2b..e6cdafb 100644 --- a/Security, Sentinel & Defender/Governance.workbook +++ b/Security, Sentinel & Defender/Governance.workbook @@ -755,7 +755,7 @@ { "name": "resourceId", "source": "cell", - "value": "%2Fsubscriptions%2F3b5bc982-20bc-4b59-b1ca-f8488bb86736%2FresourceGroups%2Fdemo%2Fproviders%2FMicrosoft.HybridCompute%2Fmachines%2FW2019" + "value": "%2Fsubscriptions%2F00000000-0000-0000-0000-000000000000%2FresourceGroups%2Fplaceholder-rg%2Fproviders%2FMicrosoft.HybridCompute%2Fmachines%2Fplaceholder-resource" } ] }, diff --git a/Security, Sentinel & Defender/Investigation Insights - v1.7.1.workbook b/Security, Sentinel & Defender/Investigation Insights - v1.7.1.workbook index 351f930..82bc9d0 100644 --- a/Security, Sentinel & Defender/Investigation Insights - v1.7.1.workbook +++ b/Security, Sentinel & Defender/Investigation Insights - v1.7.1.workbook @@ -83,7 +83,7 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/0db680e0-6664-4cda-bdfd-58a5b44598b8/resourceGroups/soc-pfp-qcyber-rg/providers/Microsoft.OperationalInsights/workspaces/soc-pfp-qcyber-ws" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ] }, { @@ -6101,7 +6101,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Investigation Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/Investigation Insights - v1.7.2.1.workbook b/Security, Sentinel & Defender/Investigation Insights - v1.7.2.1.workbook index dc34661..eef672e 100644 --- a/Security, Sentinel & Defender/Investigation Insights - v1.7.2.1.workbook +++ b/Security, Sentinel & Defender/Investigation Insights - v1.7.2.1.workbook @@ -83,10 +83,10 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourceGroups/QC-PROD-RG/providers/Microsoft.OperationalInsights/workspaces/QC-Prod", - "/subscriptions/0db680e0-6664-4cda-bdfd-58a5b44598b8/resourceGroups/soc-pfp-qcyber-rg/providers/Microsoft.OperationalInsights/workspaces/soc-pfp-qcyber-ws", - "/subscriptions/da8c34ea-09a4-4fdb-9cad-0989f1e057da/resourceGroups/azne-rg-itcore-p-sentinel-1/providers/Microsoft.OperationalInsights/workspaces/azne-la-itcore-p-sentinel-1", - "/subscriptions/da8c34ea-09a4-4fdb-9cad-0989f1e057da/resourceGroups/azne-rg-itcore-p-sentinel-1/providers/Microsoft.OperationalInsights/workspaces/azwe-la-itcore-p-sentinel-1" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ] }, { @@ -6781,7 +6781,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Investigation Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/Investigation Insights - v1.7.2.workbook b/Security, Sentinel & Defender/Investigation Insights - v1.7.2.workbook index 349020d..0a27597 100644 --- a/Security, Sentinel & Defender/Investigation Insights - v1.7.2.workbook +++ b/Security, Sentinel & Defender/Investigation Insights - v1.7.2.workbook @@ -83,8 +83,8 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/0db680e0-6664-4cda-bdfd-58a5b44598b8/resourceGroups/soc-pfp-qcyber-rg/providers/Microsoft.OperationalInsights/workspaces/soc-pfp-qcyber-ws", - "/subscriptions/bc4aec72-c094-481d-ae83-5f7fe33e5db5/resourceGroups/azrgpsenp0001/providers/Microsoft.OperationalInsights/workspaces/AZWKSSENP0001" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ] }, { @@ -6609,7 +6609,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Investigation Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/Investigation Insights - v1.7.3.workbook b/Security, Sentinel & Defender/Investigation Insights - v1.7.3.workbook index 8bd0fd0..94e82bf 100644 --- a/Security, Sentinel & Defender/Investigation Insights - v1.7.3.workbook +++ b/Security, Sentinel & Defender/Investigation Insights - v1.7.3.workbook @@ -83,9 +83,9 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourceGroups/qc-prod-rg/providers/Microsoft.OperationalInsights/workspaces/qc-prod", - "/subscriptions/da8c34ea-09a4-4fdb-9cad-0989f1e057da/resourceGroups/azne-rg-itcore-p-sentinel-1/providers/Microsoft.OperationalInsights/workspaces/azne-la-itcore-p-sentinel-1", - "/subscriptions/da8c34ea-09a4-4fdb-9cad-0989f1e057da/resourceGroups/azne-rg-itcore-p-sentinel-1/providers/Microsoft.OperationalInsights/workspaces/azwe-la-itcore-p-sentinel-1" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ] }, { @@ -6892,7 +6892,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Investigation Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/Investigation Insights - v1.7.workbook b/Security, Sentinel & Defender/Investigation Insights - v1.7.workbook index 68cac4f..c46208f 100644 --- a/Security, Sentinel & Defender/Investigation Insights - v1.7.workbook +++ b/Security, Sentinel & Defender/Investigation Insights - v1.7.workbook @@ -86,8 +86,8 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/0c175d69-5265-4d9c-b675-be1509d34024/resourceGroups/rmdk-prod-oms-rg/providers/Microsoft.OperationalInsights/workspaces/RMDK-PROD-OMS", - "/subscriptions/8ffb8c5b-ee62-4e73-a0e8-0eda6f758eec/resourceGroups/AZ-PRD-UW-RG-SecLogs/providers/Microsoft.OperationalInsights/workspaces/AZ-PRD-UW-LAW-Sentinel" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", + "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace" ] }, { @@ -5773,7 +5773,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "Community-Workbooks/Microsoft Sentinel - Workbooks/Investigation Insights", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/MITREATTCKFrameworkReferenceforAzureSentinel.workbook b/Security, Sentinel & Defender/MITREATTCKFrameworkReferenceforAzureSentinel.workbook index 26d7cc4..40def9d 100644 --- a/Security, Sentinel & Defender/MITREATTCKFrameworkReferenceforAzureSentinel.workbook +++ b/Security, Sentinel & Defender/MITREATTCKFrameworkReferenceforAzureSentinel.workbook @@ -22,7 +22,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourcegroups/rodazuresentinel/providers/microsoft.operationalinsights/workspaces/rodazuresentinelworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/PotentialMaliciousEventsMap.workbook b/Security, Sentinel & Defender/PotentialMaliciousEventsMap.workbook index 459cfe6..80c3b1a 100644 --- a/Security, Sentinel & Defender/PotentialMaliciousEventsMap.workbook +++ b/Security, Sentinel & Defender/PotentialMaliciousEventsMap.workbook @@ -41,7 +41,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourcegroups/soc/providers/microsoft.operationalinsights/workspaces/cybersecuritysoc" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/QC Sentinel Central v2.1.6 (1).workbook b/Security, Sentinel & Defender/QC Sentinel Central v2.1.6 (1).workbook index 541d5f7..08ca26c 100644 --- a/Security, Sentinel & Defender/QC Sentinel Central v2.1.6 (1).workbook +++ b/Security, Sentinel & Defender/QC Sentinel Central v2.1.6 (1).workbook @@ -2690,7 +2690,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" } ], "style": "above", diff --git a/Security, Sentinel & Defender/QC Sentinel Central v2.1.7.workbook b/Security, Sentinel & Defender/QC Sentinel Central v2.1.7.workbook index 6510cdf..0069136 100644 --- a/Security, Sentinel & Defender/QC Sentinel Central v2.1.7.workbook +++ b/Security, Sentinel & Defender/QC Sentinel Central v2.1.7.workbook @@ -72,9 +72,9 @@ "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2", - "/subscriptions/2f84d581-f18a-473f-8574-766c505c263d", - "/subscriptions/6964aee8-2b05-4f32-9a77-0c73217fe10d" + "/subscriptions/00000000-0000-0000-0000-000000000000", + "/subscriptions/00000000-0000-0000-0000-000000000000", + "/subscriptions/00000000-0000-0000-0000-000000000000" ] }, { @@ -2722,7 +2722,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" } ], "style": "above", @@ -4691,7 +4691,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/4defa7d0-bc3a-4935-a1e6-e58406cf75e2/resourcegroups/qc-prod-rg/providers/microsoft.operationalinsights/workspaces/qc-prod" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/QC Sentinel Central v2.1.8.workbook b/Security, Sentinel & Defender/QC Sentinel Central v2.1.8.workbook index f5dd3be..6e6b4fd 100644 --- a/Security, Sentinel & Defender/QC Sentinel Central v2.1.8.workbook +++ b/Security, Sentinel & Defender/QC Sentinel Central v2.1.8.workbook @@ -1840,7 +1840,7 @@ }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", - "value": "/subscriptions/6964aee8-2b05-4f32-9a77-0c73217fe10d/resourcegroups/quorumacademy/providers/microsoft.operationalinsights/workspaces/quorumacademy" + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" }, { "id": "c2494755-05cc-4b93-b253-e8a0d4b7c899", diff --git a/Security, Sentinel & Defender/Sentinel Central v1.6c.workbook b/Security, Sentinel & Defender/Sentinel Central v1.6c.workbook index 0e835cb..5fc3b11 100644 --- a/Security, Sentinel & Defender/Sentinel Central v1.6c.workbook +++ b/Security, Sentinel & Defender/Sentinel Central v1.6c.workbook @@ -1971,7 +1971,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/d1d8779d-38d7-4f06-91db-9cbc8de0176f/resourceGroups/SOC/providers/Microsoft.OperationalInsights/workspaces/CyberSecuritySOC", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/Security, Sentinel & Defender/SentinelWorkbooks-master.workbook b/Security, Sentinel & Defender/SentinelWorkbooks-master.workbook index f1c04f9..354fdce 100644 --- a/Security, Sentinel & Defender/SentinelWorkbooks-master.workbook +++ b/Security, Sentinel & Defender/SentinelWorkbooks-master.workbook @@ -48,7 +48,7 @@ "crossComponentResources": [ "{Subscription}" ], - "value": "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourceGroups/rodazuresentinel/providers/Microsoft.OperationalInsights/workspaces/rodazuresentinelworkspace", + "value": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder-rg/providers/Microsoft.OperationalInsights/workspaces/placeholder-workspace", "typeSettings": { "resourceTypeFilter": { "microsoft.operationalinsights/workspaces": true @@ -6388,7 +6388,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourcegroups/rodazuresentinel/providers/microsoft.operationalinsights/workspaces/rodazuresentinelworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/SystemUpdates.workbook b/Security, Sentinel & Defender/SystemUpdates.workbook index dc21223..5bd505b 100644 --- a/Security, Sentinel & Defender/SystemUpdates.workbook +++ b/Security, Sentinel & Defender/SystemUpdates.workbook @@ -578,7 +578,7 @@ { "name": "resourceId", "source": "cell", - "value": "%2Fsubscriptions%2F3b5bc982-20bc-4b59-b1ca-f8488bb86736%2FresourceGroups%2Fdemo%2Fproviders%2FMicrosoft.HybridCompute%2Fmachines%2FW2019" + "value": "%2Fsubscriptions%2F00000000-0000-0000-0000-000000000000%2FresourceGroups%2Fplaceholder-rg%2Fproviders%2FMicrosoft.HybridCompute%2Fmachines%2Fplaceholder-resource" } ] }, diff --git a/Security, Sentinel & Defender/User And Entity Behavior Analytics Workbook.workbook b/Security, Sentinel & Defender/User And Entity Behavior Analytics Workbook.workbook index 2fe64ce..342826c 100644 --- a/Security, Sentinel & Defender/User And Entity Behavior Analytics Workbook.workbook +++ b/Security, Sentinel & Defender/User And Entity Behavior Analytics Workbook.workbook @@ -733,7 +733,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/2959f496-711b-447e-9b85-53a1da341c4c/resourcegroups/rodazuresentinel/providers/microsoft.operationalinsights/workspaces/rodazuresentinelworkspace" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserAndEntityBehaviorAnalytics", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Security, Sentinel & Defender/parserperformance.workbook b/Security, Sentinel & Defender/parserperformance.workbook index 9ea26f0..5e0dedd 100644 --- a/Security, Sentinel & Defender/parserperformance.workbook +++ b/Security, Sentinel & Defender/parserperformance.workbook @@ -1531,7 +1531,7 @@ } ], "fallbackResourceIds": [ - "/subscriptions/1c252cf0-2140-4605-8501-932fcc039e0a/resourcegroups/sentinel/providers/microsoft.operationalinsights/workspaces/nyc3-sentinel" + "/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/placeholder-rg/providers/microsoft.operationalinsights/workspaces/placeholder-workspace" ], "fromTemplateId": "sentinel-UserWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" diff --git a/Storage & Backup/StorageAccounts.workbook b/Storage & Backup/StorageAccounts.workbook index 684bc8c..027fec9 100644 --- a/Storage & Backup/StorageAccounts.workbook +++ b/Storage & Backup/StorageAccounts.workbook @@ -81,7 +81,7 @@ "name": "Username", "type": 2, "query": "AzureActivity\r\n| extend User = tostring(Caller)\r\n| distinct User", - "value": "rodtrent@sixmilliondollarman.onmicrosoft.com", + "value": "user@example.com", "typeSettings": { "additionalResourceOptions": [] }, diff --git a/scripts/build_catalog.py b/scripts/build_catalog.py new file mode 100644 index 0000000..b2eb94e --- /dev/null +++ b/scripts/build_catalog.py @@ -0,0 +1,180 @@ +#!/usr/bin/env python3 +"""Generate CATALOG.md, an index of every workbook template in the repository. + +For each category folder the catalog lists every ``*.workbook`` file with: + +* a link to the file +* a title derived from the workbook itself (the first Markdown heading in an + always-visible text step, then any heading, then the first sentence of the + first text step, then the ``fromTemplateId`` the portal recorded, then the + file name) +* the names of the workbook's top-level parameters, which is usually the + quickest way to tell which resources a template expects +* the number of steps (items) in the workbook + +Many files were exported from the portal with generic names such as +``Overview.workbook`` or ``Cluster (3).workbook``; the derived title is what +tells them apart, so keep this catalog regenerated whenever files change. + +Usage: + python scripts/build_catalog.py # rewrite CATALOG.md + python scripts/build_catalog.py --check # exit 1 if CATALOG.md is stale +""" +from __future__ import annotations + +import argparse +import json +import re +import sys +from pathlib import Path +from urllib.parse import quote + +ROOT = Path(__file__).resolve().parent.parent +OUTPUT = ROOT / "CATALOG.md" +MAX_TITLE = 90 +MAX_PARAMS = 6 + +HEADING = re.compile(r"^\s{0,3}#{1,4}\s+(.+?)\s*#*\s*$", re.MULTILINE) +HTML_TAG = re.compile(r"<[^>]+>") +MD_LINK = re.compile(r"\[([^\]]*)\]\([^)]*\)") +MD_EMPHASIS = re.compile(r"(\*\*|__|\*|_|`)") + + +def clean_markdown(text: str) -> str: + text = HTML_TAG.sub("", text) + text = MD_LINK.sub(r"\1", text) + text = MD_EMPHASIS.sub("", text) + text = text.replace("|", "\\|") + return " ".join(text.split()) + + +def text_steps(items, include_conditional: bool): + """Yield the Markdown of text steps in document order, descending into groups. + + Steps with ``conditionalVisibility`` are usually warnings ("select a + workspace first"), so callers can skip them on a first pass. + """ + for item in items or []: + content = item.get("content") or {} + conditional = bool(item.get("conditionalVisibility") or item.get("conditionalVisibilities")) + if conditional and not include_conditional: + continue + if item.get("type") == 1: + yield content.get("json") or "" + elif item.get("type") == 12: # group step + yield from text_steps(content.get("items"), include_conditional) + + +def derive_title(items) -> str | None: + """Best-effort title: an unconditional heading, then any heading, then the first sentence.""" + for include_conditional in (False, True): + for markdown in text_steps(items, include_conditional): + match = HEADING.search(markdown) + if match: + title = clean_markdown(match.group(1)) + if title: + return title + for markdown in text_steps(items, True): + plain = clean_markdown(markdown) + if plain: + sentence = re.split(r"(?<=[.!?])\s", plain, maxsplit=1)[0] + return sentence + return None + + +def top_level_parameters(items) -> list[str]: + for item in items or []: + if item.get("type") == 9: # parameters step + names = [p.get("name") for p in (item.get("content") or {}).get("parameters") or []] + return [n for n in names if n] + return [] + + +def count_steps(items) -> int: + total = 0 + for item in items or []: + total += 1 + if item.get("type") == 12: + total += count_steps((item.get("content") or {}).get("items")) + return total + + +def describe(path: Path) -> dict: + data = json.loads(path.read_text(encoding="utf-8")) + items = data.get("items") or [] + title = derive_title(items) or data.get("fromTemplateId") or path.stem + if len(title) > MAX_TITLE: + title = title[: MAX_TITLE - 1].rstrip() + "…" + params = top_level_parameters(items) + shown = ", ".join(params[:MAX_PARAMS]) + (", …" if len(params) > MAX_PARAMS else "") + return {"title": title, "params": shown or "—", "steps": count_steps(items)} + + +def render() -> str: + categories = sorted( + (d for d in ROOT.iterdir() if d.is_dir() and not d.name.startswith(".") and d.name != "scripts"), + key=lambda d: d.name.lower(), + ) + lines = [ + "# Workbook Catalog", + "", + "_Generated by `scripts/build_catalog.py`; do not edit by hand. " + "Run `python scripts/build_catalog.py` after adding or changing workbooks._", + "", + "Titles are read from the first Markdown heading inside each workbook. " + "Files that share a name with a numeric suffix (for example `Cluster (3).workbook`) " + "are distinct templates that happened to be exported under the same name; " + "use the title and parameters to tell them apart.", + "", + "## Categories", + "", + "| Category | Workbooks |", + "| --- | ---: |", + ] + sections = [] + total = 0 + for category in categories: + files = sorted(category.glob("*.workbook"), key=lambda p: p.name.lower()) + if not files: + continue + total += len(files) + anchor = re.sub(r"[^a-z0-9 -]", "", category.name.lower()).replace(" ", "-") + lines.append(f"| [{category.name}](#{anchor}) | {len(files)} |") + section = [ + "", + f"## {category.name}", + "", + "| Workbook | Title | Parameters | Steps |", + "| --- | --- | --- | ---: |", + ] + for path in files: + info = describe(path) + href = quote(f"{category.name}/{path.name}") + name = path.name.replace("|", "\\|") + section.append(f"| [{name}]({href}) | {info['title']} | {info['params']} | {info['steps']} |") + sections.append("\n".join(section)) + lines.append(f"| **Total** | **{total}** |") + return "\n".join(lines) + "\n" + "\n".join(sections) + "\n" + + +def main(argv: list[str] | None = None) -> int: + parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0]) + parser.add_argument("--check", action="store_true", help="exit 1 if CATALOG.md is out of date") + args = parser.parse_args(argv) + + content = render() + if args.check: + current = OUTPUT.read_text(encoding="utf-8") if OUTPUT.exists() else "" + if current != content: + print("CATALOG.md is out of date; run: python scripts/build_catalog.py") + return 1 + print("CATALOG.md is up to date") + return 0 + + OUTPUT.write_text(content, encoding="utf-8") + print(f"wrote {OUTPUT.relative_to(ROOT)}") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/scrub_resource_ids.py b/scripts/scrub_resource_ids.py new file mode 100644 index 0000000..51d4222 --- /dev/null +++ b/scripts/scrub_resource_ids.py @@ -0,0 +1,116 @@ +#!/usr/bin/env python3 +"""Replace environment-specific Azure resource IDs with neutral placeholders. + +Workbooks exported from the Azure portal frequently carry the author's own +subscription ID, resource group and workspace name in ``fallbackResourceIds``, +``crossComponentResources`` and parameter default values. Those values are +useless to anyone else (the resource does not exist in their tenant) and they +leak details about the environment the workbook was exported from. + +This script rewrites every ``/subscriptions//...`` path (plain or +URL-encoded) so that: + +* the subscription GUID becomes ``00000000-0000-0000-0000-000000000000`` +* the resource group name becomes ``placeholder-rg`` +* the resource name becomes ``placeholder-workspace`` for Log Analytics + workspaces and ``placeholder-resource`` for anything else + +Provider namespaces and resource types are preserved so the workbook still +knows what kind of resource the parameter expects. Text is edited in place +without re-serialising the JSON, so formatting is untouched. + +Usage: + python scripts/scrub_resource_ids.py # rewrite files in place + python scripts/scrub_resource_ids.py --check # exit 1 if anything would change +""" +from __future__ import annotations + +import argparse +import re +import sys +from pathlib import Path + +ROOT = Path(__file__).resolve().parent.parent +PLACEHOLDER_SUB = "00000000-0000-0000-0000-000000000000" +PLACEHOLDER_RG = "placeholder-rg" +PLACEHOLDER_WS = "placeholder-workspace" +PLACEHOLDER_RES = "placeholder-resource" + +GUID = r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" + +# Plain form: /subscriptions/[/resourceGroups/[/providers///]] +# A segment ends at a slash, quote, backslash (JSON escape), whitespace or +# common delimiters that appear when IDs are embedded in query text. +_SEG = r"[^/\"'\\\s\]\[,;)(&?#%]+" +PLAIN = re.compile( + rf"/subscriptions/(?P{GUID})" + rf"(?:/(?PresourceGroups|resourcegroups)/(?P{_SEG}))?" + rf"(?:/(?Pproviders)/(?P{_SEG})/(?P{_SEG})/(?P{_SEG}))?", + re.IGNORECASE, +) + +# URL-encoded form used inside portal deep links: %2Fsubscriptions%2F%2F... +_ESEG = r"(?:[^%\"'\\\s&?#]|%(?!2[Ff]|22))+" +ENCODED = re.compile( + rf"%2[Ff]subscriptions%2[Ff](?P{GUID})" + rf"(?:%2[Ff](?PresourceGroups|resourcegroups)%2[Ff](?P{_ESEG}))?" + rf"(?:%2[Ff](?Pproviders)%2[Ff](?P{_ESEG})%2[Ff](?P{_ESEG})%2[Ff](?P{_ESEG}))?", + re.IGNORECASE, +) + +# Personal e-mail addresses that appear as parameter default values. +EMAIL = re.compile(r"[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.(?:onmicrosoft\.com|ms)\b") +PLACEHOLDER_EMAIL = "user@example.com" + + +def _rebuild(m: re.Match, sep: str) -> str: + if m.group("sub").lower() == PLACEHOLDER_SUB: + return m.group(0) + out = f"{sep}subscriptions{sep}{PLACEHOLDER_SUB}" + if m.group("rgkey"): + out += f"{sep}{m.group('rgkey')}{sep}{PLACEHOLDER_RG}" + if m.group("provkey"): + name = PLACEHOLDER_WS if m.group("type").lower() == "workspaces" else PLACEHOLDER_RES + out += f"{sep}providers{sep}{m.group('ns')}{sep}{m.group('type')}{sep}{name}" + return out + + +def scrub_text(text: str) -> str: + text = PLAIN.sub(lambda m: _rebuild(m, "/"), text) + text = ENCODED.sub(lambda m: _rebuild(m, "%2F"), text) + text = EMAIL.sub(PLACEHOLDER_EMAIL, text) + return text + + +def workbook_files(root: Path): + return sorted(p for p in root.rglob("*.workbook") if ".git" not in p.parts) + + +def main(argv: list[str] | None = None) -> int: + parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0]) + parser.add_argument("--check", action="store_true", help="report files that would change and exit 1") + parser.add_argument("paths", nargs="*", type=Path, help="files or folders to process (default: whole repo)") + args = parser.parse_args(argv) + + targets: list[Path] = [] + for p in args.paths or [ROOT]: + targets.extend(workbook_files(p) if p.is_dir() else [p]) + + changed = [] + for path in targets: + original = path.read_text(encoding="utf-8") + scrubbed = scrub_text(original) + if scrubbed != original: + changed.append(path) + if not args.check: + path.write_text(scrubbed, encoding="utf-8") + + verb = "would change" if args.check else "scrubbed" + for path in changed: + print(f"{verb}: {path.relative_to(ROOT) if path.is_relative_to(ROOT) else path}") + print(f"{len(changed)} file(s) {verb}, {len(targets)} scanned") + return 1 if (args.check and changed) else 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/validate_workbooks.py b/scripts/validate_workbooks.py new file mode 100644 index 0000000..978e155 --- /dev/null +++ b/scripts/validate_workbooks.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python3 +"""Validate every ``*.workbook`` file in the repository. + +Checks performed on each file: + +* parses as UTF-8 JSON without a byte-order mark or leading comment lines + (the Azure portal's Advanced Editor rejects both) +* top-level value is an object with ``"version": "Notebook/1.0"`` and an + ``items`` array, which is the minimum the Gallery Template editor needs +* no environment-specific ``/subscriptions//...`` resource IDs are left + in the file (see ``scrub_resource_ids.py``) +* the file lives inside a category folder, not at the repository root + +Exit status is non-zero when any error is found, so the script doubles as +the CI gate in ``.github/workflows/validate.yml``. + +Usage: + python scripts/validate_workbooks.py # whole repository + python scripts/validate_workbooks.py path/a.workbook "Networking/" +""" +from __future__ import annotations + +import argparse +import json +import re +import sys +from pathlib import Path + +ROOT = Path(__file__).resolve().parent.parent +EXPECTED_VERSION = "Notebook/1.0" +PLACEHOLDER_SUB = "00000000-0000-0000-0000-000000000000" +GUID = r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}" +SUBSCRIPTION_PATH = re.compile(rf"(?:/|%2[Ff])subscriptions(?:/|%2[Ff])({GUID})", re.IGNORECASE) + + +def workbook_files(root: Path): + return sorted(p for p in root.rglob("*.workbook") if ".git" not in p.parts) + + +def validate(path: Path) -> list[str]: + errors: list[str] = [] + raw = path.read_bytes() + + if raw.startswith(b"\xef\xbb\xbf"): + errors.append("file starts with a UTF-8 byte-order mark") + raw = raw[3:] + + try: + text = raw.decode("utf-8") + except UnicodeDecodeError as exc: + return errors + [f"not valid UTF-8: {exc}"] + + if text.lstrip().startswith("//"): + errors.append("file starts with a // comment; JSON does not allow comments") + + try: + data = json.loads(text) + except json.JSONDecodeError as exc: + return errors + [f"invalid JSON: {exc.msg} (line {exc.lineno}, column {exc.colno})"] + + if not isinstance(data, dict): + return errors + ["top-level JSON value must be an object"] + + version = data.get("version") + if version != EXPECTED_VERSION: + errors.append(f'"version" is {version!r}, expected {EXPECTED_VERSION!r}') + if not isinstance(data.get("items"), list): + errors.append('"items" must be an array') + + leaked = sorted({m.group(1).lower() for m in SUBSCRIPTION_PATH.finditer(text)} - {PLACEHOLDER_SUB}) + if leaked: + errors.append( + "contains environment-specific subscription IDs " + f"({', '.join(leaked)}); run scripts/scrub_resource_ids.py" + ) + + try: + rel = path.resolve().relative_to(ROOT) + if len(rel.parts) < 2: + errors.append("workbook must live inside a category folder, not the repository root") + except ValueError: + pass + + return errors + + +def main(argv: list[str] | None = None) -> int: + parser = argparse.ArgumentParser(description=__doc__.split("\n\n")[0]) + parser.add_argument("paths", nargs="*", type=Path, help="files or folders to validate (default: whole repo)") + args = parser.parse_args(argv) + + targets: list[Path] = [] + for p in args.paths or [ROOT]: + targets.extend(workbook_files(p) if p.is_dir() else [p]) + + failed = 0 + for path in targets: + problems = validate(path) + if problems: + failed += 1 + shown = path.relative_to(ROOT) if path.is_relative_to(ROOT) else path + print(f"FAIL {shown}") + for problem in problems: + print(f" - {problem}") + + print(f"{len(targets) - failed} passed, {failed} failed, {len(targets)} total") + return 1 if failed else 0 + + +if __name__ == "__main__": + sys.exit(main())