{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "incidentTime": {
                                "type": "string"
                            },
                            "hosts": {
                                "type": "array",
                                "items": {
                                    "type": "object",
                                    "properties": {
                                        "HostName": {
                                            "type": "string"
                                        },
                                        "NetBiosName": {
                                            "type": "string"
                                        },
                                        "DnsDomain": {
                                            "type": "string"
                                        },
                                        "OsFamily": {
                                            "type": "string"
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_HostEnrichment": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "HostEnrichment",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_HostTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "HostTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Initialize_KQLSectionHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "KQLSectionHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "For_each_Host_Enrich": {
                        "foreach": "@triggerBody()?['hosts']",
                        "actions": {
                            "Compose_Host_Name": {
                                "type": "Compose",
                                "inputs": "@coalesce(item()?['HostName'], item()?['NetBiosName'], item()?['DnsDomain'])"
                            },
                            "Compose_Timeline_Start": {
                                "runAfter": {
                                    "Compose_Host_Name": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@addMinutes(triggerBody()?['incidentTime'], -30)"
                            },
                            "Compose_Timeline_End": {
                                "runAfter": {
                                    "Compose_Host_Name": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@addMinutes(triggerBody()?['incidentTime'], 30)"
                            },
                            "Get_MDE_Device": {
                                "runAfter": {
                                    "Compose_Host_Name": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Http",
                                "inputs": {
                                    "method": "GET",
                                    "authentication": {
                                        "type": "ManagedServiceIdentity",
                                        "audience": "https://api.securitycenter.microsoft.com"
                                    },
                                    "uri": "@concat('https://api.securitycenter.microsoft.com/api/machines?$filter=startswith(computerDnsName,''', outputs('Compose_Host_Name'), ''')')"
                                }
                            },
                            "Parse_MDE_Device": {
                                "runAfter": {
                                    "Get_MDE_Device": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "ParseJson",
                                "inputs": {
                                    "content": "@coalesce(body('Get_MDE_Device'), json('{\"value\":[]}'  ))",
                                    "schema": {
                                        "type": "object",
                                        "properties": {
                                            "value": {
                                                "type": "array",
                                                "items": {
                                                    "type": "object",
                                                    "properties": {
                                                        "id": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "computerDnsName": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "osPlatform": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "osVersion": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "lastSeen": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "healthStatus": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "onboardingStatus": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "isAadJoined": {
                                                            "type": [
                                                                "boolean",
                                                                "null"
                                                            ]
                                                        },
                                                        "riskScore": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "exposureLevel": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "isolationStatus": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "managedBy": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "managedByStatus": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "defenderAvStatus": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "lastIpAddress": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "lastExternalIpAddress": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "groupName": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        },
                                                        "rbacGroupName": {
                                                            "type": [
                                                                "string",
                                                                "null"
                                                            ]
                                                        }
                                                    }
                                                }
                                            }
                                        }
                                    }
                                }
                            },
                            "Compose_MDE_Device_Found": {
                                "runAfter": {
                                    "Parse_MDE_Device": [
                                        "Succeeded",
                                        "Failed"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@greater(length(coalesce(body('Parse_MDE_Device')?['value'], json('[]'))), 0)"
                            },
                            "Compose_MDE_First_Device": {
                                "runAfter": {
                                    "Compose_MDE_Device_Found": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@coalesce(body('Parse_MDE_Device')?['value']?[0], json('{\"id\":null,\"computerDnsName\":null,\"osPlatform\":null,\"osVersion\":null,\"lastSeen\":null,\"healthStatus\":\"Unknown\",\"onboardingStatus\":\"Unknown\",\"isAadJoined\":null,\"riskScore\":\"Unknown\",\"exposureLevel\":\"Unknown\",\"isolationStatus\":\"None\",\"managedBy\":null,\"defenderAvStatus\":null,\"lastIpAddress\":null,\"lastExternalIpAddress\":null,\"rbacGroupName\":null}'))"
                            },
                            "Run_Defender_Process_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceProcessEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | where FileName !in (\"SenseIR.exe\",\"MicrosoftEdgeUpdate.exe\") | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, AccountDomain, ProcessId, InitiatingProcessId | order by TimeGenerated asc | take 20')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Run_Defender_Network_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceNetworkEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | project TimeGenerated, DeviceName, ActionType, RemoteIP, RemotePort, RemoteUrl, LocalIP, LocalPort, Protocol, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated asc | take 30')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Run_Defender_File_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceFileEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName | order by TimeGenerated asc | take 30')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Run_Defender_Logon_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceLogonEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | project TimeGenerated, DeviceName, ActionType, AccountName, AccountDomain, LogonType, RemoteIP, IsLocalAdmin, InitiatingProcessFileName | order by TimeGenerated asc | take 20')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Run_Defender_DeviceAlerts_KQL": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('SecurityAlert | where TimeGenerated > ago(7d) | where ProductName == \"Microsoft Defender Advanced Threat Protection\" or ProviderName == \"MDATP\" | where CompromisedEntity startswith \"', outputs('Compose_Host_Name'), '\" or Entities has \"', outputs('Compose_Host_Name'), '\" | project TimeGenerated, AlertName, AlertSeverity, Status, CompromisedEntity, ProductName, ProviderName, Tactics, Techniques, Description, VendorOriginalId, SystemAlertId, Entities | order by TimeGenerated desc | take 20')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "7d"
                                    }
                                }
                            },
                            "Run_Defender_DeviceEvents_KQL": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | where ActionType has_any (\"AntivirusDetection\",\"AntivirusScanCompleted\",\"TamperingAttempt\",\"SmartScreenUrlWarning\",\"SmartScreenAppWarning\",\"PowerShellCommand\",\"AmsiScriptDetection\",\"AsrLsassCredentialTheftAudited\",\"AsrExecutableEmailContentAudited\",\"AsrUntrustedExecutableAudited\",\"ExploitGuardNetworkProtectionAudited\",\"ControlFlowGuardViolation\") | project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, AdditionalFields | order by TimeGenerated asc | take 20')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Count_Process_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceProcessEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | where FileName !in (\"SenseIR.exe\",\"MicrosoftEdgeUpdate.exe\") | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Count_Network_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceNetworkEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Count_File_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceFileEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Count_Logon_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceLogonEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Count_Device_Alerts": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('SecurityAlert | where TimeGenerated > ago(7d) | where ProductName == \"Microsoft Defender Advanced Threat Protection\" or ProviderName == \"MDATP\" | where CompromisedEntity startswith \"', outputs('Compose_Host_Name'), '\" or Entities has \"', outputs('Compose_Host_Name'), '\" | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "7d"
                                    }
                                }
                            },
                            "Count_Device_Events": {
                                "runAfter": {
                                    "Compose_Timeline_Start": [
                                        "Succeeded"
                                    ],
                                    "Compose_Timeline_End": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "ApiConnection",
                                "inputs": {
                                    "host": {
                                        "connection": {
                                            "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']"
                                        }
                                    },
                                    "method": "post",
                                    "body": "@concat('DeviceEvents | where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\")) | where DeviceName startswith \"', outputs('Compose_Host_Name'), '\" | where ActionType has_any (\"AntivirusDetection\",\"AntivirusScanCompleted\",\"TamperingAttempt\",\"SmartScreenUrlWarning\",\"SmartScreenAppWarning\",\"PowerShellCommand\",\"AmsiScriptDetection\",\"AsrLsassCredentialTheftAudited\",\"AsrExecutableEmailContentAudited\",\"AsrUntrustedExecutableAudited\",\"ExploitGuardNetworkProtectionAudited\",\"ControlFlowGuardViolation\") | summarize TotalCount=count()')",
                                    "path": "/queryData",
                                    "queries": {
                                        "subscriptions": "<AZURE-SUBSCRIPTION-ID>",
                                        "resourcegroups": "<RESOURCE-GROUP>",
                                        "resourcetype": "Log Analytics Workspace",
                                        "resourcename": "<LOG-ANALYTICS-WORKSPACE>",
                                        "timerange": "1d"
                                    }
                                }
                            },
                            "Compose_Host_KQL_Block": {
                                "runAfter": {
                                    "Run_Defender_Process_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_Defender_Network_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_Defender_File_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_Defender_Logon_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_Defender_DeviceAlerts_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Run_Defender_DeviceEvents_KQL": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_Process_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_Network_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_File_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_Logon_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_Device_Alerts": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Count_Device_Events": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ],
                                    "Compose_MDE_First_Device": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@concat('<div style=\"border-left:4px solid #2980b9;padding:10px 14px;margin-bottom:20px;background:#f8fafd\"><strong style=\"color:#1a5276;font-size:13px\">&#128421; ', outputs('Compose_Host_Name'), '</strong><span style=\"color:#7f8c8d;font-size:11px;margin-left:10px\">&#8987; Window: ', outputs('Compose_Timeline_Start'), ' &rarr; ', outputs('Compose_Timeline_End'), '</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#9881; DeviceProcessEvents (&#177;30 min)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceProcessEvents<br>| where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\"))<br>| where DeviceName startswith \"', outputs('Compose_Host_Name'), '\"<br>| where FileName !in (\"SenseIR.exe\",\"MicrosoftEdgeUpdate.exe\")<br>| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, ProcessCommandLine,<br>         InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, AccountDomain,<br>         ProcessId, InitiatingProcessId<br>| order by TimeGenerated asc<br>| take 20</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#127760; DeviceNetworkEvents (&#177;30 min)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceNetworkEvents<br>| where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\"))<br>| where DeviceName startswith \"', outputs('Compose_Host_Name'), '\"<br>| project TimeGenerated, DeviceName, ActionType, RemoteIP, RemotePort, RemoteUrl,<br>         LocalIP, LocalPort, Protocol, InitiatingProcessFileName,<br>         InitiatingProcessCommandLine, InitiatingProcessAccountName<br>| order by TimeGenerated asc<br>| take 30</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#128196; DeviceFileEvents (&#177;30 min)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceFileEvents<br>| where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\"))<br>| where DeviceName startswith \"', outputs('Compose_Host_Name'), '\"<br>| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256,<br>         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName<br>| order by TimeGenerated asc<br>| take 30</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#128272; DeviceLogonEvents (&#177;30 min)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceLogonEvents<br>| where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\"))<br>| where DeviceName startswith \"', outputs('Compose_Host_Name'), '\"<br>| project TimeGenerated, DeviceName, ActionType, AccountName, AccountDomain,<br>         LogonType, RemoteIP, IsLocalAdmin, InitiatingProcessFileName<br>| order by TimeGenerated asc<br>| take 20</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#128680; SecurityAlert &mdash; MDE (7d lookback)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">SecurityAlert<br>| where TimeGenerated &gt; ago(7d)<br>| where ProductName == \"Microsoft Defender Advanced Threat Protection\"<br>    or ProviderName == \"MDATP\"<br>| where CompromisedEntity startswith \"', outputs('Compose_Host_Name'), '\"<br>    or Entities has \"', outputs('Compose_Host_Name'), '\"<br>| project TimeGenerated, AlertName, AlertSeverity, Status, CompromisedEntity,<br>         ProductName, ProviderName, Tactics, Techniques, Description,<br>         VendorOriginalId, SystemAlertId, Entities<br>| order by TimeGenerated desc<br>| take 20</span><br><br><strong style=\"font-size:12px;color:#2471a3\">&#128737; DeviceEvents &mdash; Security ActionTypes (&#177;30 min)</strong><br><span style=\"font-family:Consolas,Courier New,monospace;font-size:11px;color:#1c2833;white-space:pre\">DeviceEvents<br>| where TimeGenerated between (datetime(\"', outputs('Compose_Timeline_Start'), '\") .. datetime(\"', outputs('Compose_Timeline_End'), '\"))<br>| where DeviceName startswith \"', outputs('Compose_Host_Name'), '\"<br>| where ActionType has_any (<br>    \"AntivirusDetection\",\"AntivirusScanCompleted\",\"TamperingAttempt\",<br>    \"SmartScreenUrlWarning\",\"SmartScreenAppWarning\",\"PowerShellCommand\",<br>    \"AmsiScriptDetection\",\"AsrLsassCredentialTheftAudited\",<br>    \"AsrExecutableEmailContentAudited\",\"AsrUntrustedExecutableAudited\",<br>    \"ExploitGuardNetworkProtectionAudited\",\"ControlFlowGuardViolation\")<br>| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256,<br>         ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,<br>         AccountName, AdditionalFields<br>| order by TimeGenerated asc<br>| take 20</span></div>')"
                            },
                            "Append_Host_Enrichment": {
                                "runAfter": {
                                    "Compose_Host_KQL_Block": [
                                        "Succeeded",
                                        "Failed"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "HostEnrichment",
                                    "value": {
                                        "hostName": "@outputs('Compose_Host_Name')",
                                        "osPlatform": "@coalesce(item()?['OsFamily'], outputs('Compose_MDE_First_Device')?['osPlatform'], 'Unknown')",
                                        "timelineStart": "@outputs('Compose_Timeline_Start')",
                                        "timelineEnd": "@outputs('Compose_Timeline_End')",
                                        "mdeDeviceId": "@coalesce(outputs('Compose_MDE_First_Device')?['id'], 'Not found')",
                                        "mdeDeviceFound": "@outputs('Compose_MDE_Device_Found')",
                                        "mdeComputerDnsName": "@coalesce(outputs('Compose_MDE_First_Device')?['computerDnsName'], 'Unknown')",
                                        "mdeHealthStatus": "@coalesce(outputs('Compose_MDE_First_Device')?['healthStatus'], 'Unknown')",
                                        "mdeOnboardingStatus": "@coalesce(outputs('Compose_MDE_First_Device')?['onboardingStatus'], 'Unknown')",
                                        "mdeIsAadJoined": "@string(coalesce(outputs('Compose_MDE_First_Device')?['isAadJoined'], false))",
                                        "mdeRiskScore": "@coalesce(outputs('Compose_MDE_First_Device')?['riskScore'], 'Unknown')",
                                        "mdeExposureLevel": "@coalesce(outputs('Compose_MDE_First_Device')?['exposureLevel'], 'Unknown')",
                                        "mdeIsolationStatus": "@coalesce(outputs('Compose_MDE_First_Device')?['isolationStatus'], 'None')",
                                        "mdeManagedBy": "@coalesce(outputs('Compose_MDE_First_Device')?['managedBy'], 'Unknown')",
                                        "mdeAvStatus": "@coalesce(outputs('Compose_MDE_First_Device')?['defenderAvStatus'], 'Unknown')",
                                        "mdeLastSeen": "@coalesce(outputs('Compose_MDE_First_Device')?['lastSeen'], 'Unknown')",
                                        "mdeLastIp": "@coalesce(outputs('Compose_MDE_First_Device')?['lastIpAddress'], 'Unknown')",
                                        "mdeLastExternalIp": "@coalesce(outputs('Compose_MDE_First_Device')?['lastExternalIpAddress'], 'Unknown')",
                                        "mdeRbacGroup": "@coalesce(outputs('Compose_MDE_First_Device')?['rbacGroupName'], 'Unknown')",
                                        "processEvents": "@coalesce(body('Run_Defender_Process_Events')?['value'], json('[]'))",
                                        "networkEvents": "@coalesce(body('Run_Defender_Network_Events')?['value'], json('[]'))",
                                        "fileEvents": "@coalesce(body('Run_Defender_File_Events')?['value'], json('[]'))",
                                        "logonEvents": "@coalesce(body('Run_Defender_Logon_Events')?['value'], json('[]'))",
                                        "existingAlerts": "@coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]'))",
                                        "existingAlertCount": "@length(coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]')))",
                                        "deviceEvents": "@coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]'))",
                                        "deviceEventCount": "@length(coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]')))",
                                        "processEventTotal": "@coalesce(body('Count_Process_Events')?['value']?[0]?['TotalCount'], 0)",
                                        "networkEventTotal": "@coalesce(body('Count_Network_Events')?['value']?[0]?['TotalCount'], 0)",
                                        "fileEventTotal": "@coalesce(body('Count_File_Events')?['value']?[0]?['TotalCount'], 0)",
                                        "logonEventTotal": "@coalesce(body('Count_Logon_Events')?['value']?[0]?['TotalCount'], 0)",
                                        "alertTotal": "@coalesce(body('Count_Device_Alerts')?['value']?[0]?['TotalCount'], 0)",
                                        "deviceEventTotal": "@coalesce(body('Count_Device_Events')?['value']?[0]?['TotalCount'], 0)",
                                        "queriesRunHTML": "@outputs('Compose_Host_KQL_Block')"
                                    }
                                }
                            },
                            "Append_Host_KQL_Section": {
                                "runAfter": {
                                    "Append_Host_Enrichment": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "KQLSectionHTML",
                                    "value": "@outputs('Compose_Host_KQL_Block')"
                                }
                            },
                            "Append_Host_Row_Open": {
                                "runAfter": {
                                    "Append_Host_Enrichment": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace;font-weight:bold\">', outputs('Compose_Host_Name'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(item()?['OsFamily'], outputs('Compose_MDE_First_Device')?['osPlatform'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;text-align:center\">', outputs('Compose_Timeline_Start'), '<br>to<br>', outputs('Compose_Timeline_End'), '</td>')"
                                }
                            },
                            "Append_Host_Row_Process": {
                                "runAfter": {
                                    "Append_Host_Row_Open": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;', if(greater(coalesce(body('Count_Process_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Process_Events')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_Process_Events')?['value'], json('[]')))), '/', string(coalesce(body('Count_Process_Events')?['value']?[0]?['TotalCount'], 0)), if(greater(coalesce(body('Count_Process_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Process_Events')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_Network": {
                                "runAfter": {
                                    "Append_Host_Row_Process": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;', if(greater(coalesce(body('Count_Network_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Network_Events')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_Network_Events')?['value'], json('[]')))), '/', string(coalesce(body('Count_Network_Events')?['value']?[0]?['TotalCount'], 0)), if(greater(coalesce(body('Count_Network_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Network_Events')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_File": {
                                "runAfter": {
                                    "Append_Host_Row_Network": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;', if(greater(coalesce(body('Count_File_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_File_Events')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_File_Events')?['value'], json('[]')))), '/', string(coalesce(body('Count_File_Events')?['value']?[0]?['TotalCount'], 0)), if(greater(coalesce(body('Count_File_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_File_Events')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_Logon": {
                                "runAfter": {
                                    "Append_Host_Row_File": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;', if(greater(coalesce(body('Count_Logon_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Logon_Events')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_Logon_Events')?['value'], json('[]')))), '/', string(coalesce(body('Count_Logon_Events')?['value']?[0]?['TotalCount'], 0)), if(greater(coalesce(body('Count_Logon_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_Logon_Events')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_Alerts": {
                                "runAfter": {
                                    "Append_Host_Row_Logon": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]'))), 0), '#c0392b', '#27ae60'), ';', if(greater(coalesce(body('Count_Device_Alerts')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]')))), '/', string(coalesce(body('Count_Device_Alerts')?['value']?[0]?['TotalCount'], 0)), ' alerts', if(greater(coalesce(body('Count_Device_Alerts')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_DeviceAlerts_KQL')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_DeviceEvents": {
                                "runAfter": {
                                    "Append_Host_Row_Alerts": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;color:', if(greater(length(coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]'))), 0), '#e67e22', '#888'), ';', if(greater(coalesce(body('Count_Device_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]')))), 'background:#fff3cd;', ''), '\">', string(length(coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]')))), '/', string(coalesce(body('Count_Device_Events')?['value']?[0]?['TotalCount'], 0)), ' events', if(greater(coalesce(body('Count_Device_Events')?['value']?[0]?['TotalCount'], 0), length(coalesce(body('Run_Defender_DeviceEvents_KQL')?['value'], json('[]')))), ' ⚠', ''), '</td>')"
                                }
                            },
                            "Append_Host_Row_MDE_Open": {
                                "runAfter": {
                                    "Compose_MDE_Cell_BgColor": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat('<td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;', outputs('Compose_MDE_Cell_BgColor'), '\">', if(outputs('Compose_MDE_Device_Found'), concat('<strong>&#128737; ', coalesce(outputs('Compose_MDE_First_Device')?['computerDnsName'], outputs('Compose_Host_Name')), '</strong><br>'), '<em style=\"color:#888\">&#9888; Not in MDE</em>'))"
                                }
                            },
                            "Append_Host_Row_MDE_IsoHealth": {
                                "runAfter": {
                                    "Append_Host_Row_MDE_Open": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@if(outputs('Compose_MDE_Device_Found'), concat('<span style=\"color:', if(not(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['isolationStatus'], 'none')), 'none')), '#c0392b', '#27ae60'), ';font-weight:bold\">Isolation: ', coalesce(outputs('Compose_MDE_First_Device')?['isolationStatus'], 'None'), '</span><br>Health: <span style=\"color:', if(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['healthStatus'], '')), 'active'), '#27ae60', '#c0392b'), '\">', coalesce(outputs('Compose_MDE_First_Device')?['healthStatus'], 'Unknown'), '</span><br>'), '')"
                                }
                            },
                            "Append_Host_Row_MDE_RiskExp": {
                                "runAfter": {
                                    "Append_Host_Row_MDE_IsoHealth": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@if(outputs('Compose_MDE_Device_Found'), concat('Risk: <span style=\"color:', if(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['riskScore'], '')), 'high'), '#c0392b', if(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['riskScore'], '')), 'medium'), '#e67e22', '#27ae60')), '\">', coalesce(outputs('Compose_MDE_First_Device')?['riskScore'], 'Unknown'), '</span><br>Exposure: ', coalesce(outputs('Compose_MDE_First_Device')?['exposureLevel'], 'Unknown')), '')"
                                }
                            },
                            "Append_Host_Row_MDE_Part2": {
                                "runAfter": {
                                    "Append_Host_Row_MDE_RiskExp": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "HostTableHTML",
                                    "value": "@concat(if(outputs('Compose_MDE_Device_Found'), concat('<br>Onboarding: ', coalesce(outputs('Compose_MDE_First_Device')?['onboardingStatus'], 'Unknown'), '<br>AV: ', coalesce(outputs('Compose_MDE_First_Device')?['defenderAvStatus'], 'Unknown'), '<br>AAD: ', if(equals(string(coalesce(outputs('Compose_MDE_First_Device')?['isAadJoined'], false)), 'true'), '✔ Joined', '✘ Not joined'), '<br>Last seen: ', coalesce(outputs('Compose_MDE_First_Device')?['lastSeen'], 'Unknown'), '<br>IP: ', coalesce(outputs('Compose_MDE_First_Device')?['lastIpAddress'], 'Unknown'), '<br>Group: ', coalesce(outputs('Compose_MDE_First_Device')?['rbacGroupName'], 'Unknown')), ''), '</td></tr>')"
                                }
                            },
                            "Compose_MDE_Cell_BgColor": {
                                "runAfter": {
                                    "Append_Host_Row_DeviceEvents": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "Compose",
                                "inputs": "@if(not(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['isolationStatus'], 'none')), 'none')), 'background:#fdecea;', if(or(equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['riskScore'], '')), 'high'), equals(toLower(coalesce(outputs('Compose_MDE_First_Device')?['healthStatus'], '')), 'inactive')), 'background:#fff3cd;', ''))"
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "For_each_Host_Enrich": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "hostTableHTML": "@variables('HostTableHTML')",
                                "kqlSectionHTML": "@variables('KQLSectionHTML')",
                                "results": "@variables('HostEnrichment')"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_HostEnrichment": [
                        "Succeeded"
                    ],
                    "Initialize_HostTableHTML": [
                        "Succeeded"
                    ],
                    "Initialize_KQLSectionHTML": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {
                "azuremonitorlogs": {
                    "id": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/providers/Microsoft.Web/locations/westus2/managedApis/azuremonitorlogs",
                    "connectionId": "/subscriptions/<AZURE-SUBSCRIPTION-ID>/resourceGroups/<RESOURCE-GROUP>/providers/Microsoft.Web/connections/azuremonitorlogs-1",
                    "connectionName": "azuremonitorlogs-1",
                    "connectionProperties": {}
                }
            }
        }
    }
}