phone-failures-dashboard.json

{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "12e24ac4-d5f3-42ec-9c32-118fd5438150",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 300000
                },
                {
                  "durationMs": 900000
                },
                {
                  "durationMs": 1800000
                },
                {
                  "durationMs": 3600000
                },
                {
                  "durationMs": 14400000
                },
                {
                  "durationMs": 43200000
                },
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 172800000
                },
                {
                  "durationMs": 259200000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 1209600000
                },
                {
                  "durationMs": 2419200000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 5184000000
                },
                {
                  "durationMs": 7776000000
                }
              ],
              "allowCustom": true
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize count() by Result\n| summarize TotalFailure = sum(count_), Title = \"Total Failures\", Subtitle=\"Phone Related\"",
        "size": 4,
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "tiles",
        "tileSettings": {
          "titleContent": {
            "columnMatch": "Title",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "TotalFailure",
            "formatter": 18,
            "formatOptions": {
              "thresholdsOptions": "icons",
              "thresholdsGrid": [
                {
                  "operator": "Default",
                  "thresholdValue": null,
                  "representation": "2",
                  "text": "{0}{1}"
                }
              ]
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "style": "decimal",
                "useGrouping": false,
                "maximumFractionDigits": 2,
                "maximumSignificantDigits": 3
              }
            }
          },
          "secondaryContent": {
            "columnMatch": "Subtitle"
          },
          "showBorder": true
        }
      },
      "name": "query - 11"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "tabs",
        "links": [
          {
            "id": "71ab978a-c66d-47dc-aa0a-6a1a1b5d4d93",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Overview",
            "subTarget": "DataType",
            "style": "link"
          },
          {
            "id": "4ba27946-dc0b-4978-b5d6-97591a3bac6e",
            "cellValue": "selectedTab",
            "linkTarget": "parameter",
            "linkLabel": "Details",
            "subTarget": "OverTime",
            "style": "link"
          }
        ]
      },
      "name": "links - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \r\n    { \r\n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\r\n       let i =  indexof(data,ipStr);\r\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\r\n       let k =  substring(data,i+strlen(ipStr));\r\n       let ClientIpAddress = split(k,'\"')[0];\r\n       ClientIpAddress\r\n    };\r\nAuditLogs\r\n| where OperationName contains \"verify\" \r\n| extend addtionalDetails = tostring(AdditionalDetails)\r\n| where addtionalDetails contains \"VerificationMethod\"\r\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\r\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\r\n| where Result != \"success\"\r\n| extend  Method=strcat(ad1,\",\",ad2)\r\n| where Method contains(\"PhoneCall\")\r\n| extend x = indexof(addtionalDetails,'+')\r\n| extend y = indexof(addtionalDetails,'\"',x)\r\n| extend Phone =  substring(addtionalDetails,x,y-x )\r\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\r\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, Reason=ResultDescription, OperationName, addtionalDetails\r\n| summarize  FailureCount = count() by Reason\r\n| order by FailureCount",
        "size": 1,
        "showAnalytics": true,
        "title": "Failure Reasons",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Reason",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "info",
                    "text": "{0}{1}"
                  }
                ]
              }
            },
            {
              "columnMatch": "FailureCount",
              "formatter": 20,
              "formatOptions": {
                "palette": "orangeRed"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "showPin": true,
      "name": "query - 0",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| where ResultDescription contains(\"Phone number has bad reputation\")\n| summarize Count = count() by Phone\n| order by Count\n| render  table   \n",
        "size": 1,
        "showAnalytics": true,
        "title": "Blocked Due To Bad Reputation",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "redBright",
                "aggregation": "Count"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "name": "query - 1",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize Count = count() by IPAddress\n| order by Count\n| render  table   ",
        "size": 1,
        "showAnalytics": true,
        "title": "IP Address With Failed Phone Authentications",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "redBright",
                "aggregation": "Count"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "name": "query - 1 - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize Count = count() by Phone, IPAddress\n| order by Count\n| render  table   ",
        "size": 1,
        "showAnalytics": true,
        "title": "Phone Numbers With IP Address - Failed Phone Authentications",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "redPurple",
                "aggregation": "Count"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "name": "query - 1 - Copy - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| extend AgentDetails = parse_user_agent(extractjson(\"$.[3].value\",tostring(AdditionalDetails)), dynamic([\"browser\",\"os\",\"device\"])) \n| extend BrowserFamily=extractjson(\"$.['Browser'].Family\",tostring(AgentDetails))\n| extend BrowserMajorVersion=extractjson(\"$.['Browser'].MajorVersion\",tostring(AgentDetails))\n| extend BrowserMinorVersion=extractjson(\"$.['Browser'].MinorVersion\",tostring(AgentDetails))\n| extend DeviceFamily=extractjson(\"$.['Device'].Family\",tostring(AgentDetails))\n| extend DeviceBrand=extractjson(\"$.['Device'].Brand\",tostring(AgentDetails))\n| extend DeviceModel=extractjson(\"$.['Device'].Model\",tostring(AgentDetails))\n| extend OSFamily=extractjson(\"$.['OperatingSystem'].Family\",tostring(AgentDetails))\n| extend OSMajorVersion=extractjson(\"$.['OperatingSystem'].MajorVersion\",tostring(AgentDetails))\n| extend OSMinorVersion=extractjson(\"$.['OperatingSystem'].MinorVersion\",tostring(AgentDetails))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),BrowserFamily,OSFamily,Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize Count = count() by BrowserFamily\n| order by Count\n| render  table   \n",
        "size": 1,
        "showAnalytics": true,
        "title": "Browser",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "redPurple",
                "aggregation": "Count"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "BrowserFamily",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "name": "query - 1 - Copy - Copy - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| extend AgentDetails = parse_user_agent(extractjson(\"$.[3].value\",tostring(AdditionalDetails)), dynamic([\"browser\",\"os\",\"device\"])) \n| extend BrowserFamily=extractjson(\"$.['Browser'].Family\",tostring(AgentDetails))\n| extend BrowserMajorVersion=extractjson(\"$.['Browser'].MajorVersion\",tostring(AgentDetails))\n| extend BrowserMinorVersion=extractjson(\"$.['Browser'].MinorVersion\",tostring(AgentDetails))\n| extend DeviceFamily=extractjson(\"$.['Device'].Family\",tostring(AgentDetails))\n| extend DeviceBrand=extractjson(\"$.['Device'].Brand\",tostring(AgentDetails))\n| extend DeviceModel=extractjson(\"$.['Device'].Model\",tostring(AgentDetails))\n| extend OSFamily=extractjson(\"$.['OperatingSystem'].Family\",tostring(AgentDetails))\n| extend OSMajorVersion=extractjson(\"$.['OperatingSystem'].MajorVersion\",tostring(AgentDetails))\n| extend OSMinorVersion=extractjson(\"$.['OperatingSystem'].MinorVersion\",tostring(AgentDetails))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),BrowserFamily,OSFamily,Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize Count = count() by OSFamily\n| order by Count\n| render  table   \n",
        "size": 1,
        "showAnalytics": true,
        "title": "Operating System",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 4,
              "formatOptions": {
                "palette": "redPurple",
                "aggregation": "Count"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "DataType"
      },
      "customWidth": "50",
      "name": "query - 1 - Copy - Copy - Copy - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \r\n    { \r\n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\r\n       let i =  indexof(data,ipStr);\r\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\r\n       let k =  substring(data,i+strlen(ipStr));\r\n       let ClientIpAddress = split(k,'\"')[0];\r\n       ClientIpAddress\r\n    };\r\nAuditLogs\r\n| where OperationName contains \"verify\" \r\n| extend addtionalDetails = tostring(AdditionalDetails)\r\n| where addtionalDetails contains \"VerificationMethod\"\r\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\r\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\r\n| where Result != \"success\"\r\n| where ResultDescription contains (\"reputation\")\r\n| extend  Method=strcat(ad1,\",\",ad2)\r\n| where Method contains(\"PhoneCall\")\r\n| extend x = indexof(addtionalDetails,'+')\r\n| extend y = indexof(addtionalDetails,'\"',x)\r\n| extend Phone =  substring(addtionalDetails,x,y-x )\r\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\r\n| project TimeGenerated,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress, OperationName\r\n//| order by Count\r\n//| render  table   \r\n",
        "size": 2,
        "showAnalytics": true,
        "title": "Azure AD B2C Policy - Failed Phone Authentications",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Policy",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "Normal",
                    "text": "{0}{1}"
                  }
                ]
              }
            },
            {
              "columnMatch": "Phone",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "3",
                    "text": "{0}{1}"
                  }
                ]
              }
            },
            {
              "columnMatch": "OperationName",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "2",
                    "text": "{0}{1}"
                  }
                ]
              }
            },
            {
              "columnMatch": "TotalAuth",
              "formatter": 4,
              "formatOptions": {
                "palette": "greenDarkDark"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "ClientId",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "TotalAuth",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        },
        "chartSettings": {
          "xAxis": "TotalAuth",
          "yAxis": [
            "ClientId"
          ]
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "customWidth": "50",
      "showPin": true,
      "name": "query - 2",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| where ResultDescription contains( \"Phone number has bad reputation\")\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| summarize Count = count() by Phone, bin (TimeGenerated,1d)\n| order by Count\n| render  timechart   \n",
        "size": 2,
        "showAnnotations": true,
        "showAnalytics": true,
        "title": "Phone Authentications Failures by Phone Number - Time Chart",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "greenBlue"
              },
              "numberFormat": {
                "unit": 17,
                "options": {
                  "style": "decimal",
                  "useGrouping": false
                }
              }
            }
          ]
        },
        "tileSettings": {
          "showBorder": false,
          "titleContent": {
            "columnMatch": "IdP",
            "formatter": 1
          },
          "leftContent": {
            "columnMatch": "IdentityProviders",
            "formatter": 12,
            "formatOptions": {
              "palette": "auto"
            },
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          }
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "customWidth": "50",
      "name": "query - 3",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \r\n    { \r\n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\r\n       let i =  indexof(data,ipStr);\r\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\r\n       let k =  substring(data,i+strlen(ipStr));\r\n       let ClientIpAddress = split(k,'\"')[0];\r\n       ClientIpAddress\r\n    };\r\nAuditLogs\r\n| where OperationName contains \"verify\" \r\n| extend addtionalDetails = tostring(AdditionalDetails)\r\n| where addtionalDetails contains \"VerificationMethod\"\r\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\r\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\r\n| where Result != \"success\"\r\n| extend  Method=strcat(ad1,\",\",ad2)\r\n| where Method contains(\"PhoneCall\")\r\n| extend x = indexof(addtionalDetails,'+')\r\n| extend y = indexof(addtionalDetails,'\"',x)\r\n| extend Phone =  substring(addtionalDetails,x,y-x )\r\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\r\n| where ResultDescription contains( \"Phone number has bad reputation\")\r\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\r\n| summarize Count = count() by Policy, bin (TimeGenerated,1d)\r\n| order by Count\r\n| render  timechart   ",
        "size": 0,
        "showAnnotations": true,
        "showAnalytics": true,
        "title": "Phone Authentications Failures by Azure AD B2C Policy  - Time Chart",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "blueDark"
              }
            }
          ]
        },
        "tileSettings": {
          "titleContent": {
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Policy",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "nodeIdField": "Policy",
          "sourceIdField": "Count",
          "targetIdField": "Count",
          "graphOrientation": 3,
          "showOrientationToggles": false,
          "edgeSize": "Count",
          "edgeLabel": "Policy",
          "nodeSize": {
            "sizeField": "Policy",
            "minSize": null,
            "maxSize": null
          },
          "staticNodeSize": 100,
          "colorSettings": null,
          "hivesMargin": 5
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "Count",
          "sizeAggregation": "Sum",
          "legendMetric": "Count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "Count",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "customWidth": "50",
      "showPin": true,
      "name": "query - 5",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \r\n    { \r\n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\r\n       let i =  indexof(data,ipStr);\r\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\r\n       let k =  substring(data,i+strlen(ipStr));\r\n       let ClientIpAddress = split(k,'\"')[0];\r\n       ClientIpAddress\r\n    };\r\nAuditLogs\r\n| where OperationName contains \"verify\" \r\n| extend addtionalDetails = tostring(AdditionalDetails)\r\n| where addtionalDetails contains \"VerificationMethod\"\r\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\r\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\r\n| where Result != \"success\"\r\n| extend  Method=strcat(ad1,\",\",ad2)\r\n| where Method contains(\"PhoneCall\")\r\n| extend x = indexof(addtionalDetails,'+')\r\n| extend y = indexof(addtionalDetails,'\"',x)\r\n| extend Phone =  substring(addtionalDetails,x,y-x )\r\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\r\n| where ResultDescription contains( \"Phone number has bad reputation\")\r\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\r\n| summarize Count = count() by IPAddress, bin (TimeGenerated,1d)\r\n| order by Count\r\n| render  timechart   ",
        "size": 0,
        "showAnnotations": true,
        "showAnalytics": true,
        "title": "Phone Authentications Failures by IP Address - Time Chart",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "areachart",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Total",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              }
            },
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "coldHot"
              }
            }
          ]
        },
        "tileSettings": {
          "titleContent": {
            "formatter": 1,
            "formatOptions": {
              "showIcon": true
            }
          },
          "leftContent": {
            "columnMatch": "Count",
            "formatter": 12,
            "formatOptions": {
              "showIcon": true
            }
          },
          "showBorder": false
        },
        "graphSettings": {
          "type": 0,
          "topContent": {
            "columnMatch": "Policy",
            "formatter": 1
          },
          "centerContent": {
            "columnMatch": "Count",
            "formatter": 1,
            "numberFormat": {
              "unit": 17,
              "options": {
                "maximumSignificantDigits": 3,
                "maximumFractionDigits": 2
              }
            }
          },
          "nodeIdField": "Policy",
          "sourceIdField": "Count",
          "targetIdField": "Count",
          "graphOrientation": 3,
          "showOrientationToggles": false,
          "edgeSize": "Count",
          "edgeLabel": "Policy",
          "nodeSize": {
            "sizeField": "Policy",
            "minSize": null,
            "maxSize": null
          },
          "staticNodeSize": 100,
          "colorSettings": null,
          "hivesMargin": 5
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "Count",
          "sizeAggregation": "Sum",
          "legendMetric": "Count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "Count",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "customWidth": "50",
      "showPin": true,
      "name": "query - 5 - Copy",
      "styleSettings": {
        "showBorder": true
      }
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "let getCallerIpAddress = (data:string) \n    { \n       let ipStr= 'ClientIpAddress\",\"value\":\"'; //This is located within the additionalDetails attribute within the AuditLog\n       let i =  indexof(data,ipStr);\n       let j = indexof(data,'\"',i+strlen(ipStr)+1);\n       let k =  substring(data,i+strlen(ipStr));\n       let ClientIpAddress = split(k,'\"')[0];\n       ClientIpAddress\n    };\nAuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| where Result != \"success\"\n| extend  Method=strcat(ad1,\",\",ad2)\n| where Method contains(\"PhoneCall\")\n| extend x = indexof(addtionalDetails,'+')\n| extend y = indexof(addtionalDetails,'\"',x)\n| extend Phone =  substring(addtionalDetails,x,y-x )\n| extend IPAddress= tostring((getCallerIpAddress(AdditionalDetails)))\n| project TimeGenerated, CorrelationId,Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)),Phone,IPAddress,Method, Result, ResultDescription, OperationName, addtionalDetails\n| where ResultDescription contains( \"Phone number has bad reputation\")\n| summarize Count = count() by Phone\n| order by Count desc\n| render  table   \n",
        "size": 2,
        "title": "Select Phone Number To View Failure Details",
        "color": "orange",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "exportFieldName": "Phone",
        "exportParameterName": "PhoneNumber",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "Phone",
              "formatter": 1
            },
            {
              "columnMatch": "Count",
              "formatter": 8,
              "formatOptions": {
                "palette": "orange"
              }
            }
          ],
          "rowLimit": 10000,
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "name": "query - 9"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "AuditLogs\n| where OperationName contains \"verify\" \n| extend addtionalDetails = tostring(AdditionalDetails)\n| where addtionalDetails contains \"VerificationMethod\"\n| extend ad1=extractjson(\"$.[5].value\",tostring(AdditionalDetails))\n| extend ad2 = extractjson(\"$.[4].value\",tostring(AdditionalDetails))\n| extend Method=strcat(ad1,\",\",ad2)\n| where Result != \"success\"\n| where Method contains ('{PhoneNumber}')\n| project TimeGenerated, CorrelationId, ResultDescription,Method, Policy=extractjson(\"$.[1].value\",tostring(AdditionalDetails)), OperationName\n| order by TimeGenerated desc",
        "size": 0,
        "noDataMessage": " Please select a phone number to view details.",
        "timeContext": {
          "durationMs": 2592000000
        },
        "timeContextFromParameter": "TimeRange",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "gridSettings": {
          "formatters": [
            {
              "columnMatch": "ResultDescription",
              "formatter": 18,
              "formatOptions": {
                "thresholdsOptions": "icons",
                "thresholdsGrid": [
                  {
                    "operator": "contains",
                    "thresholdValue": "Phone number has bad reputation, blocking",
                    "representation": "3",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "contains",
                    "thresholdValue": "The phone verification is pending.",
                    "representation": "2",
                    "text": "{0}{1}"
                  },
                  {
                    "operator": "Default",
                    "thresholdValue": null,
                    "representation": "1",
                    "text": "{0}{1}"
                  }
                ]
              }
            }
          ],
          "filter": true
        }
      },
      "conditionalVisibility": {
        "parameterName": "selectedTab",
        "comparison": "isEqualTo",
        "value": "OverTime"
      },
      "name": "query - 14"
    }
  ],
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}