diff --git a/Solutions/Cribl/Data/Solution_Cribl.json b/Solutions/Cribl/Data/Solution_Cribl.json
index 1355622f2ec..a425b46494d 100644
--- a/Solutions/Cribl/Data/Solution_Cribl.json
+++ b/Solutions/Cribl/Data/Solution_Cribl.json
@@ -3,6 +3,7 @@
     "Author": "Cribl - tap@cribl.io",
     "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Cribl-Logo.svg\" width=\"75px\" height=\"75px\">",
     "Description": "Cribl is a vendor neutral, purpose-built processing engine for data security and IT operations focused on centralized parsing and processing of event data.",
+    "WorkbookBladeDescription": "Monitor Cribl Logs across Access, Audit, Internal & UI Access.",
     "Data Connectors": [
       "Data Connectors/Connector_Cribl.json"
     ],
@@ -12,9 +13,12 @@
       "Parsers/CriblInternal.yaml",
       "Parsers/CriblUIAccess.yaml"
     ],
+    "Workbooks": [
+    "Workbooks/CriblWorkbook.json"
+    ],
     "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Cribl",
     "Version": "3.0.0",
     "Metadata": "SolutionMetadata.json",
     "TemplateSpec": true,
     "Is1Pconnector": false
-  }
\ No newline at end of file
+  }
diff --git a/Solutions/Cribl/Package/3.0.1.zip b/Solutions/Cribl/Package/3.0.1.zip
index 706a0d08af2..5dd21256f2e 100644
Binary files a/Solutions/Cribl/Package/3.0.1.zip and b/Solutions/Cribl/Package/3.0.1.zip differ
diff --git a/Solutions/Cribl/Package/createUiDefinition.json b/Solutions/Cribl/Package/createUiDefinition.json
index b6b9c4358b7..32f2b3e22cd 100644
--- a/Solutions/Cribl/Package/createUiDefinition.json
+++ b/Solutions/Cribl/Package/createUiDefinition.json
@@ -6,7 +6,7 @@
     "config": {
       "isWizard": false,
       "basics": {
-        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Cribl-Logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cribl/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nCribl is a vendor neutral, purpose-built processing engine for data security and IT operations focused on centralized parsing and processing of event data.\n\n**Data Connectors:** 1, **Parsers:** 4\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+        "description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Cribl-Logo.svg\" width=\"75px\" height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cribl/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nCribl is a vendor neutral, purpose-built processing engine for data security and IT operations focused on centralized parsing and processing of event data.\n\n**Data Connectors:** 1, **Parsers:** 4, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
         "subscription": {
           "resourceProviders": [
             "Microsoft.OperationsManagement/solutions",
@@ -81,6 +81,48 @@
             }
           }
         ]
+      },
+      {
+        "name": "workbooks",
+        "label": "Workbooks",
+        "subLabel": {
+          "preValidation": "Configure the workbooks",
+          "postValidation": "Done"
+        },
+        "bladeTitle": "Workbooks",
+        "elements": [
+          {
+            "name": "workbooks-text",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "text": "Monitor Cribl Logs across Access, Audit, INternal & UI Access."
+            }
+          },
+          {
+            "name": "workbooks-link",
+            "type": "Microsoft.Common.TextBlock",
+            "options": {
+              "link": {
+                "label": "Learn more",
+                "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+              }
+            }
+          },
+          {
+            "name": "workbook1",
+            "type": "Microsoft.Common.Section",
+            "label": "Cribl Workbook",
+            "elements": [
+              {
+                "name": "workbook1-text",
+                "type": "Microsoft.Common.TextBlock",
+                "options": {
+                  "text": "This workbook provides insights into Cribl."
+                }
+              }
+            ]
+          }
+        ]
       }
     ],
     "outputs": {
diff --git a/Solutions/Cribl/Package/mainTemplate.json b/Solutions/Cribl/Package/mainTemplate.json
index a29c63d01d1..6728a6f8b3c 100644
--- a/Solutions/Cribl/Package/mainTemplate.json
+++ b/Solutions/Cribl/Package/mainTemplate.json
@@ -27,6 +27,14 @@
       "metadata": {
         "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
       }
+    },
+    "workbook1-name": {
+      "type": "string",
+      "defaultValue": "Cribl Workbook",
+      "minLength": 1,
+      "metadata": {
+        "description": "Name for the workbook"
+      }
     }
   },
   "variables": {
@@ -73,6 +81,13 @@
       "parserVersion4": "1.0.1",
       "parserContentId4": "CriblUIAccess-Parser"
     },
+    "workbookVersion1": "1.0.0",
+    "workbookContentId1": "Cribl",
+    "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+    "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+    "_workbookContentId1": "[variables('workbookContentId1')]",
+    "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+    "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
     "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
   },
   "resources": [
@@ -401,7 +416,7 @@
           "resources": [
             {
               "name": "[variables('parserObject1')._parserName1]",
-              "apiVersion": "2022-10-01",
+              "apiVersion": "2025-07-01",
               "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
               "location": "[parameters('workspace-location')]",
               "properties": {
@@ -466,7 +481,7 @@
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-      "apiVersion": "2022-10-01",
+      "apiVersion": "2025-07-01",
       "name": "[variables('parserObject1')._parserName1]",
       "location": "[parameters('workspace-location')]",
       "properties": {
@@ -533,7 +548,7 @@
           "resources": [
             {
               "name": "[variables('parserObject2')._parserName2]",
-              "apiVersion": "2022-10-01",
+              "apiVersion": "2025-07-01",
               "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
               "location": "[parameters('workspace-location')]",
               "properties": {
@@ -598,7 +613,7 @@
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-      "apiVersion": "2022-10-01",
+      "apiVersion": "2025-07-01",
       "name": "[variables('parserObject2')._parserName2]",
       "location": "[parameters('workspace-location')]",
       "properties": {
@@ -665,7 +680,7 @@
           "resources": [
             {
               "name": "[variables('parserObject3')._parserName3]",
-              "apiVersion": "2022-10-01",
+              "apiVersion": "2025-07-01",
               "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
               "location": "[parameters('workspace-location')]",
               "properties": {
@@ -730,7 +745,7 @@
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-      "apiVersion": "2022-10-01",
+      "apiVersion": "2025-07-01",
       "name": "[variables('parserObject3')._parserName3]",
       "location": "[parameters('workspace-location')]",
       "properties": {
@@ -797,7 +812,7 @@
           "resources": [
             {
               "name": "[variables('parserObject4')._parserName4]",
-              "apiVersion": "2022-10-01",
+              "apiVersion": "2025-07-01",
               "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
               "location": "[parameters('workspace-location')]",
               "properties": {
@@ -862,7 +877,7 @@
     },
     {
       "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-      "apiVersion": "2022-10-01",
+      "apiVersion": "2025-07-01",
       "name": "[variables('parserObject4')._parserName4]",
       "location": "[parameters('workspace-location')]",
       "properties": {
@@ -911,6 +926,106 @@
         }
       }
     },
+    {
+      "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+      "apiVersion": "2023-04-01-preview",
+      "name": "[variables('workbookTemplateSpecName1')]",
+      "location": "[parameters('workspace-location')]",
+      "dependsOn": [
+        "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+      ],
+      "properties": {
+        "description": "CriblWorkbook Workbook with template version 3.0.1",
+        "mainTemplate": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "[variables('workbookVersion1')]",
+          "parameters": {},
+          "variables": {},
+          "resources": [
+            {
+              "type": "Microsoft.Insights/workbooks",
+              "name": "[variables('workbookContentId1')]",
+              "location": "[parameters('workspace-location')]",
+              "kind": "shared",
+              "apiVersion": "2021-08-01",
+              "metadata": {
+                "description": "This workbook provides insights into Cribl."
+              },
+              "properties": {
+                "displayName": "[parameters('workbook1-name')]",
+                "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Cribl Workbook\\r\\n\\r\\nThis Workbook contains summary of \\r\\n\\r\\n\\r\\n| Access Logs    | Audit Logs      |  Internal Logs | UI Access Logs|\\r\\n| -------------- | --------------- | -------------- |-------------- |\\r\\n|||||\"},\"customWidth\":\"50\",\"name\":\"text - 19\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"007ea1ee-99dd-4c59-bc0f-7eb8b1e05c71\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeGenerated\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 21\"},{\"type\":1,\"content\":{\"json\":\"# Access Logs\\n---\\n\",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| summarize Count = count() by tostring(status)\",\"size\":1,\"title\":\"Summary of HTTP Status Code\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"HTTP Status Code Overview\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| summarize count() by method\\n\",\"size\":1,\"title\":\"Summary of HTTP Methods\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"33\",\"name\":\"HTTP Status Code Overview - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| summarize Count = count() by src\",\"size\":1,\"title\":\"Summary of Source\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"33\",\"name\":\"HTTP Status Code Overview - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| summarize Hits = count() by url\\n| top 10 by Hits\\n\",\"size\":0,\"title\":\"Top Accessed API Endpoints\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"Top Accessed API Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| where status >= 400\\n| summarize ErrorCount = count() by tostring(status)\\n| sort by ErrorCount desc\\n\",\"size\":0,\"title\":\"HTTP Error Code Summary\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"HTTP Error Code Summary\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAccess\\n| summarize AvgResponseTime = avg(response_time) by url\\n| top 10 by AvgResponseTime\\n\\n\",\"size\":0,\"title\":\"API Response Time Analysis\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"API Response Time Analysis\"},{\"type\":1,\"content\":{\"json\":\"#  Audit Logs\\n---\\n\",\"style\":\"info\"},\"name\":\"text - 2 - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by service\\n\",\"size\":1,\"title\":\"Summary of Servies\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"customWidth\":\"50\",\"name\":\"HTTP Status Code Overview - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by user\\n| top 5 by Count\\n\",\"size\":1,\"title\":\"Top 5 Users by Audit Events\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"Top 5 Users by Audit Events\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by bin(event_time, {TimeGenerated:grain})\\n\",\"size\":0,\"title\":\"Requests Over Time\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"Requests Over Time\"}]},\"name\":\"group - 32\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by action\\n| order by Count desc\\n\",\"size\":0,\"title\":\"Most Performed Audit Actions\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"Most Performed Audit Actions\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize UniqueUsers = dcount(user) by action\\n| order by UniqueUsers desc\\n\",\"size\":0,\"title\":\"User Participation by Action Type\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"User Participation by Action Type\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by bin(event_time, 5m)\\n| order by event_time asc\\n\",\"size\":0,\"title\":\"Audit Event Activity Over Time\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"Audit Event Activity Over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblAudit\\n| summarize Count = count() by service, action\\n| order by service asc\\n\",\"size\":0,\"title\":\"Actions by Cribl Service Module\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"Actions by Cribl Service Module\"},{\"type\":1,\"content\":{\"json\":\"#  Internal Logs\\n---\\n\",\"style\":\"info\"},\"name\":\"text - 2 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblInternal\\n| summarize avg(cpuPerc) by service\\n| order by avg_cpuPerc desc\\n\",\"size\":0,\"title\":\"Average CPU Usage per Cribl Component\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"Average CPU Usage per Cribl Component\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblInternal\\n| summarize avg(mem_rss) by service\\n| order by avg_mem_rss desc\\n\",\"size\":0,\"title\":\"Average Memory (RSS) Usage by Component\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"Average Memory (RSS) Usage by Component\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblInternal\\n| summarize avg(cpuPerc) , avg(eluPerc) by bin(event_time, 1m)\\n| order by event_time asc\\n\",\"size\":0,\"title\":\"CPU vs ELU Over Time\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\"},\"name\":\"CPU vs ELU Over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblInternal\\n| summarize avg(mem_heap), avg(mem_heapTotal) by bin(event_time, 1m)\\n\",\"size\":0,\"title\":\"Heap vs Total Heap Memory Over Time\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"name\":\"Heap vs Total Heap Memory Over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblInternal\\n| summarize avg(mem_rss) by instance\\n| top 5 by avg_mem_rss\\n\",\"size\":0,\"title\":\"Top 5 Hosts by RSS Memory Usage\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"Top 5 Hosts by RSS Memory Usage\"},{\"type\":1,\"content\":{\"json\":\"#  UI Access Logs\\n---\\n\",\"style\":\"info\"},\"name\":\"text - 2 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize Count = count() by user\\n| top 5 by Count\\n\",\"size\":1,\"title\":\"Top 5 Users Accessing Cribl UI\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"Top 5 Users Accessing Cribl UI\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize Count = count() by tenantId\\n| top 5 by Count\\n\",\"size\":1,\"title\":\"Top 5 Tenants Accessing Cribl UI\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true}},\"customWidth\":\"50\",\"name\":\"Top 5 Tenants Accessing Cribl UI\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize Count = count() by url\\n| order by Count desc\\n\",\"size\":0,\"title\":\"Most Accessed UI Pages\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\"},\"name\":\"Most Accessed UI Pages\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize AccessCount = count() by bin(event_time, 1m)\\n| order by event_time asc\\n\",\"size\":0,\"title\":\"Cribl UI Access Trend\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"name\":\"Cribl UI Access Trend\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize AccessCount = count() by src\\n| top 10 by AccessCount\\n\",\"size\":0,\"title\":\"Top Source IPs Accessing UI\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"Top Source IPs Accessing UI\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CriblUIAccess\\n| summarize Count = count() by http_user_agent\\n| top 5 by Count\\n\",\"size\":0,\"title\":\"Most Common Browsers & Tools\",\"timeContextFromParameter\":\"TimeGenerated\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"Most Common Browsers & Tools\"}],\"fromTemplateId\":\"sentinel-CriblWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n",
+                "version": "1.0",
+                "sourceId": "[variables('workspaceResourceId')]",
+                "category": "sentinel"
+              }
+            },
+            {
+              "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+              "apiVersion": "2022-01-01-preview",
+              "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+              "properties": {
+                "description": "@{workbookKey=Cribl; logoFileName=Azure_Sentinel.svg; description=This workbook provides insights into Cribl.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Cribl Workbook; templateRelativePath=CriblWorkbook.json; subtitle=; provider=Microsoft Sentinel Community; support=; author=}.description",
+                "parentId": "[variables('workbookId1')]",
+                "contentId": "[variables('_workbookContentId1')]",
+                "kind": "Workbook",
+                "version": "[variables('workbookVersion1')]",
+                "source": {
+                  "kind": "Solution",
+                  "name": "Cribl",
+                  "sourceId": "[variables('_solutionId')]"
+                },
+                "author": {
+                  "name": "Cribl",
+                  "email": "[variables('_email')]"
+                },
+                "support": {
+                  "tier": "Partner",
+                  "name": "Cribl",
+                  "email": "support@cribl.io",
+                  "link": "https://www.cribl.io/support/"
+                },
+                "dependencies": {
+                  "operator": "AND",
+                  "criteria": [
+                    {
+                      "contentId": "CriblAccess_CL",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "CriblAudit_CL",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "CriblInternal_CL",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "CriblUIAccess_CL",
+                      "kind": "DataType"
+                    },
+                    {
+                      "contentId": "Cribl",
+                      "kind": "DataConnector"
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        },
+        "packageKind": "Solution",
+        "packageVersion": "[variables('_solutionVersion')]",
+        "packageName": "[variables('_solutionName')]",
+        "packageId": "[variables('_solutionId')]",
+        "contentSchemaVersion": "3.0.0",
+        "contentId": "[variables('_workbookContentId1')]",
+        "contentKind": "Workbook",
+        "displayName": "[parameters('workbook1-name')]",
+        "contentProductId": "[variables('_workbookcontentProductId1')]",
+        "id": "[variables('_workbookcontentProductId1')]",
+        "version": "[variables('workbookVersion1')]"
+      }
+    },
     {
       "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
       "apiVersion": "2023-04-01-preview",
@@ -921,7 +1036,7 @@
         "contentSchemaVersion": "3.0.0",
         "displayName": "Cribl",
         "publisherDisplayName": "Cribl",
-        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cribl/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Cribl is a vendor neutral, purpose-built processing engine for data security and IT operations focused on centralized parsing and processing of event data.</p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 4</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
+        "descriptionHtml": "<p><strong>Note:</strong> Please refer to the following before installing the solution:</p>\n<p>• Review the solution <a href=\"https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Cribl/ReleaseNotes.md\">Release Notes</a></p>\n<p>• There may be <a href=\"https://aka.ms/sentinelsolutionsknownissues\">known issues</a> pertaining to this Solution, please refer to them before installing.</p>\n<p>Cribl is a vendor neutral, purpose-built processing engine for data security and IT operations focused on centralized parsing and processing of event data.</p>\n<p><strong>Data Connectors:</strong> 1, <strong>Parsers:</strong> 4, <strong>Workbooks:</strong> 1</p>\n<p><a href=\"https://aka.ms/azuresentinel\">Learn more about Microsoft Sentinel</a> | <a href=\"https://aka.ms/azuresentinelsolutionsdoc\">Learn more about Solutions</a></p>\n",
         "contentKind": "Solution",
         "contentProductId": "[variables('_solutioncontentProductId')]",
         "id": "[variables('_solutioncontentProductId')]",
@@ -970,6 +1085,11 @@
               "kind": "Parser",
               "contentId": "[variables('parserObject4').parserContentId4]",
               "version": "[variables('parserObject4').parserVersion4]"
+            },
+            {
+              "kind": "Workbook",
+              "contentId": "[variables('_workbookContentId1')]",
+              "version": "[variables('workbookVersion1')]"
             }
           ]
         },
diff --git a/Solutions/Cribl/Package/testParameters.json b/Solutions/Cribl/Package/testParameters.json
index e55ec41a9ac..8f80225defc 100644
--- a/Solutions/Cribl/Package/testParameters.json
+++ b/Solutions/Cribl/Package/testParameters.json
@@ -20,5 +20,13 @@
     "metadata": {
       "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
     }
+  },
+  "workbook1-name": {
+    "type": "string",
+    "defaultValue": "Cribl Workbook",
+    "minLength": 1,
+    "metadata": {
+      "description": "Name for the workbook"
+    }
   }
 }
diff --git a/Solutions/Cribl/Workbooks/CriblWorkbook.json b/Solutions/Cribl/Workbooks/CriblWorkbook.json
new file mode 100644
index 00000000000..3ff6cf3335f
--- /dev/null
+++ b/Solutions/Cribl/Workbooks/CriblWorkbook.json
@@ -0,0 +1,564 @@
+{
+  "version": "Notebook/1.0",
+  "items": [
+    {
+      "type": 1,
+      "content": {
+        "json": "# Cribl Workbook\r\n\r\nThis Workbook contains summary of \r\n\r\n\r\n| Access Logs | Audit Logs | Internal Logs | UI Access Logs|\r\n| -------------- | --------------- | -------------- | -------------- |\r\n| Included | Included | Included | Included |"
+      },
+      "customWidth": "50",
+      "name": "text - 19"
+    },
+    {
+      "type": 9,
+      "content": {
+        "version": "KqlParameterItem/1.0",
+        "parameters": [
+          {
+            "id": "007ea1ee-99dd-4c59-bc0f-7eb8b1e05c71",
+            "version": "KqlParameterItem/1.0",
+            "name": "TimeGenerated",
+            "type": 4,
+            "typeSettings": {
+              "selectableValues": [
+                {
+                  "durationMs": 300000
+                },
+                {
+                  "durationMs": 900000
+                },
+                {
+                  "durationMs": 1800000
+                },
+                {
+                  "durationMs": 3600000
+                },
+                {
+                  "durationMs": 14400000
+                },
+                {
+                  "durationMs": 43200000
+                },
+                {
+                  "durationMs": 86400000
+                },
+                {
+                  "durationMs": 172800000
+                },
+                {
+                  "durationMs": 259200000
+                },
+                {
+                  "durationMs": 604800000
+                },
+                {
+                  "durationMs": 1209600000
+                },
+                {
+                  "durationMs": 2419200000
+                },
+                {
+                  "durationMs": 2592000000
+                },
+                {
+                  "durationMs": 5184000000
+                },
+                {
+                  "durationMs": 7776000000
+                }
+              ],
+              "allowCustom": true
+            },
+            "timeContext": {
+              "durationMs": 86400000
+            },
+            "value": {
+              "durationMs": 86400000
+            }
+          }
+        ],
+        "style": "pills",
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces"
+      },
+      "customWidth": "50",
+      "name": "parameters - 21"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "# Access Logs\n---\n",
+        "style": "info"
+      },
+      "name": "text - 2"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| summarize Count = count() by tostring(status)",
+        "size": 1,
+        "title": "Summary of HTTP Status Code",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "piechart",
+        "chartSettings": {
+          "showMetrics": false,
+          "showLegend": true
+        }
+      },
+      "customWidth": "33",
+      "name": "HTTP Status Code Overview"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| summarize count() by method\n",
+        "size": 1,
+        "title": "Summary of HTTP Methods",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "piechart",
+        "chartSettings": {
+          "showMetrics": false,
+          "showLegend": true
+        }
+      },
+      "customWidth": "33",
+      "name": "httpMethodSummary"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| summarize Count = count() by src",
+        "size": 1,
+        "title": "Summary of Source",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "table",
+        "gridSettings": {
+          "formatters": [
+            {
+              "columnMatch": "Count",
+              "formatter": 8,
+              "formatOptions": {
+                "palette": "blue"
+              }
+            }
+          ]
+        }
+      },
+      "customWidth": "33",
+      "name": "httpMethodsSummary"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| summarize Hits = count() by url\n| top 10 by Hits\n",
+        "size": 0,
+        "title": "Top Accessed API Endpoints",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "categoricalbar"
+      },
+      "name": "Top Accessed API Endpoints"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| extend statusCode = toint(status)\n| where statusCode >= 400\n| summarize ErrorCount = count() by tostring(statusCode)\n| sort by ErrorCount desc\n",
+        "size": 0,
+        "title": "HTTP Error Code Summary",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "barchart"
+      },
+      "name": "HTTP Error Code Summary"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAccess\n| summarize AvgResponseTime = avg(response_time) by url\n| top 10 by AvgResponseTime\n\n",
+        "size": 0,
+        "title": "API Response Time Analysis",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "unstackedbar"
+      },
+      "name": "API Response Time Analysis"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "#  Audit Logs\n---\n",
+        "style": "info"
+      },
+      "name": "text - 2 - Copy"
+    },
+    {
+      "type": 12,
+      "content": {
+        "version": "NotebookGroup/1.0",
+        "groupType": "editable",
+        "items": [
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "CriblAudit\n| summarize Count = count() by service\n",
+              "size": 1,
+              "title": "Summary of Services",
+              "timeContextFromParameter": "TimeGenerated",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "gridSettings": {
+                "formatters": [
+                  {
+                    "columnMatch": "Count",
+                    "formatter": 8,
+                    "formatOptions": {
+                      "palette": "blue"
+                    }
+                  }
+                ]
+              }
+            },
+            "customWidth": "50",
+            "name": "auditServiceSummaryTable"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "CriblAudit\n| summarize Count = count() by user\n| top 5 by Count\n",
+              "size": 1,
+              "title": "Top 5 Users by Audit Events",
+              "timeContextFromParameter": "TimeGenerated",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "visualization": "piechart",
+              "chartSettings": {
+                "showMetrics": false,
+                "showLegend": true
+              }
+            },
+            "customWidth": "50",
+            "name": "Top 5 Users by Audit Events"
+          },
+          {
+            "type": 3,
+            "content": {
+              "version": "KqlItem/1.0",
+              "query": "CriblAudit\n| where event_time between ({TimeGenerated:start} .. {TimeGenerated:end})\n| summarize Count = count() by bin(event_time, {TimeGenerated:grain})\n",
+              "size": 0,
+              "title": "Requests Over Time",
+              "timeContextFromParameter": "TimeGenerated",
+              "showRefreshButton": true,
+              "showExportToExcel": true,
+              "queryType": 0,
+              "resourceType": "microsoft.operationalinsights/workspaces",
+              "visualization": "timechart"
+            },
+            "name": "Requests Over Time"
+          }
+        ]
+      },
+      "name": "auditLogsRequestsOverTimeGroup"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAudit\n| summarize Count = count() by action\n| order by Count desc\n",
+        "size": 0,
+        "title": "Most Performed Audit Actions",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "unstackedbar"
+      },
+      "name": "Most Performed Audit Actions"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAudit\n| summarize UniqueUsers = dcount(user) by action\n| order by UniqueUsers desc\n",
+        "size": 0,
+        "title": "User Participation by Action Type",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "categoricalbar"
+      },
+      "name": "User Participation by Action Type"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAudit\n| where event_time between (datetime({TimeGenerated:start}) .. datetime({TimeGenerated:end}))\n| summarize Count = count() by bin(event_time, 5m)\n| order by event_time asc\n",
+        "size": 0,
+        "title": "Audit Event Activity Over Time",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "timechart"
+      },
+      "name": "Audit Event Activity Over Time"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblAudit\n| summarize Count = count() by service, action\n| order by service asc\n",
+        "size": 0,
+        "title": "Actions by Cribl Service Module",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "barchart"
+      },
+      "name": "Actions by Cribl Service Module"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "#  Internal Logs\n---\n",
+        "style": "info"
+      },
+      "name": "text - 2 - Copy - Copy"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblInternal\n| summarize avg(cpuPerc) by service\n| order by avg_cpuPerc desc\n",
+        "size": 0,
+        "title": "Average CPU Usage per Cribl Component",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "unstackedbar"
+      },
+      "name": "Average CPU Usage per Cribl Component"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblInternal\n| summarize avg(mem_rss) by service\n| order by avg_mem_rss desc\n",
+        "size": 0,
+        "title": "Average Memory (RSS) Usage by Component",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "categoricalbar"
+      },
+      "name": "Average Memory (RSS) Usage by Component"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblInternal\n| where event_time between ({TimeGenerated:start} .. {TimeGenerated:end})\n| summarize avg(cpuPerc), avg(eluPerc) by bin(event_time, {TimeGenerated:grain})\n",
+        "size": 0,
+        "title": "CPU vs ELU Over Time",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "linechart"
+      },
+      "name": "CPU vs ELU Over Time"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblInternal\n| summarize avg(mem_heap), avg(mem_heapTotal) by bin(event_time, 1m)\n",
+        "size": 0,
+        "title": "Heap vs Total Heap Memory Over Time",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "areachart"
+      },
+      "name": "Heap vs Total Heap Memory Over Time"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblInternal\n| summarize avg(mem_rss) by instance\n| top 5 by avg_mem_rss\n",
+        "size": 0,
+        "title": "Top 5 Hosts by RSS Memory Usage",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "barchart"
+      },
+      "name": "Top 5 Hosts by RSS Memory Usage"
+    },
+    {
+      "type": 1,
+      "content": {
+        "json": "#  UI Access Logs\n---\n",
+        "style": "info"
+      },
+      "name": "text - 2 - Copy - Copy - Copy"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| summarize Count = count() by user\n| top 5 by Count\n",
+        "size": 1,
+        "title": "Top 5 Users Accessing Cribl UI",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "piechart",
+        "chartSettings": {
+          "showMetrics": false,
+          "showLegend": true
+        }
+      },
+      "customWidth": "50",
+      "name": "Top 5 Users Accessing Cribl UI"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| summarize Count = count() by tenantId\n| top 5 by Count\n",
+        "size": 1,
+        "title": "Top 5 Tenants Accessing Cribl UI",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "piechart",
+        "chartSettings": {
+          "showMetrics": false,
+          "showLegend": true
+        }
+      },
+      "customWidth": "50",
+      "name": "Top 5 Tenants Accessing Cribl UI"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| summarize Count = count() by url\n| order by Count desc\n",
+        "size": 0,
+        "title": "Most Accessed UI Pages",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "unstackedbar"
+      },
+      "name": "Most Accessed UI Pages"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| where event_time between (datetime({TimeGenerated:start}) .. datetime({TimeGenerated:end}))\n| summarize AccessCount = count() by bin(event_time, 1m)\n| order by event_time asc\n",
+        "size": 0,
+        "title": "Cribl UI Access Trend",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "timechart"
+      },
+      "name": "Cribl UI Access Trend"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| summarize AccessCount = count() by src\n| top 10 by AccessCount\n",
+        "size": 0,
+        "title": "Top Source IPs Accessing UI",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "barchart"
+      },
+      "name": "Top Source IPs Accessing UI"
+    },
+    {
+      "type": 3,
+      "content": {
+        "version": "KqlItem/1.0",
+        "query": "CriblUIAccess\n| summarize Count = count() by http_user_agent\n| top 5 by Count\n",
+        "size": 0,
+        "title": "Most Common Browsers & Tools",
+        "timeContextFromParameter": "TimeGenerated",
+        "showRefreshButton": true,
+        "showExportToExcel": true,
+        "queryType": 0,
+        "resourceType": "microsoft.operationalinsights/workspaces",
+        "visualization": "categoricalbar"
+      },
+      "name": "Most Common Browsers & Tools"
+    }
+  ],
+  "fromTemplateId": "sentinel-CriblWorkbook",
+  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}