Domain 4 of 4 · Chapter 3 of 3

Create and Configure Microsoft Sentinel Workbooks

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security Operations Analyst Associate premium course — no separate purchase.

Included in this chapter:

  • What a workbook is, and how its parts fit
  • Activate and customize workbook templates
  • Create a custom workbook with KQL
  • Configure visualizations for query results
  • Parameters make a workbook interactive
  • Exam-pattern recognition

Which Sentinel surface for the task

GoalWorkbookAnalytics ruleHunting query
Primary jobVisualize and monitorDetect and alertSearch for unknown threats
OutputInteractive charts and gridsIncident or alertResult set plus bookmarks
RunsOn demand when openedOn a scheduleInteractively, on demand
Built fromKQL plus visualizations and parametersKQL plus trigger and thresholdKQL, saved as a query
Reusable artifactSaved workbook, can be pinnedEnabled ruleSaved hunting query

Decision tree

What is the goal?Display data:reuse and share it?Analytics rulescheduled, alertsHunting queryinteractive, bookmarksWorkbook:template available?Logs queryone-off, ad hocActivate templateSave copy, customizeCustom workbookAdd query, write KQLAlways: a TimeRange parameterDisplay dataAlertSearch a threatYesNoYesNo
Cheat sheet

Cheat sheet

  • A workbook visualizes and monitors; it never detects or responds on its own
  • A workbook is composed of parameter, text, and query items
  • Activate a template, then customize the saved copy, rather than starting blank
  • A template is read-only; only the saved copy is editable
  • Templates arrive bundled in Content hub solutions, not standalone
  • A saved workbook is governed by Azure RBAC on where you save it
  • Each query item pairs one KQL query with one visualization
  • The Visualization dropdown overrides the KQL render operator
  • Workbooks can query many data sources, not only Log Analytics
  • Match the visualization to the shape of the KQL result
  • The grid supports column renderers for heatmaps, thresholds, bars, and links
  • A parameter referenced as {Name} substitutes into the queries below it
  • Use one TimeRange parameter so a single picker rescopes every query
  • A dropdown parameter can be data-driven from a KQL query
  • Drill-downs pass a clicked value into a parameter on a target view
  • Workbooks are portable JSON you can move and source-control
  • Organize long workbooks with groups, tabs, and conditional visibility
  • Choose a workbook over a Logs query only when the view is reused
  • A saved workbook can be pinned to an Azure dashboard
  • render must be the last operator and only injects a Visualization annotation, leaving data unchanged

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data
  2. https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview
  3. https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-deploy
  4. https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-data-sources
  5. https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-visualizations
  6. https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-grid-visualizations
  7. https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-parameters