Learning Path 7 - Lab 1 - Exercise 10 - Create workbooks
Lab scenario
You are a Security Operations Analyst working at a company that implemented Microsoft Sentinel. Once you have connected your data sources to Microsoft Sentinel, you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks, which provides versatility in creating custom dashboards.
Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.
Task 1: Explore workbook templates
In this task, you will explore the Microsoft Sentinel workbook templates.
-
Login to WIN1 virtual machine as Admin with the password: Pa55w.rd.
-
In the Edge browser, navigate to the Azure portal at https://portal.azure.com.
-
In the Sign in dialog box, copy and paste in the Tenant Email account provided by your lab hosting provider and then select Next.
-
In the Enter password dialog box, copy and paste in the Tenant Password provided by your lab hosting provider and then select Sign in.
-
In the Search bar of the Azure portal, type Sentinel, then select Microsoft Sentinel.
-
Select your Microsoft Sentinel Workspace.
-
Select Workbooks. The Templates tab is selected by default.
-
Search for and select the Identity & Access template workbook. In the right pane, scroll down and select the View template button.
-
Review the contents of the workbook. It shows insights into Identity and access operations by collecting and analyzing security logs, using the audit and sign-in logs to gather insights into use of Microsoft products.
-
Close the workbook by selecting the X in the top-right corner.
Task 2: Save and modify a workbook template
In this task, you will save a workbook template and modify it.
-
You should be back in the Microsoft Sentinel - Workbooks - Templates tab. Search for and select Azure AD Audit logs, in the right pane, scroll down and select the Save button.
-
Leave East US as the default value for Region and select OK.
-
Select the View saved workbook button.
-
Select Edit in command bar to enable changes in the workbook.
-
Scroll down to the User activities area, look at the colors in the graph for “Operations count” and “Trend” since we are going to format those columns. Select the Edit button below the grid.
-
Select the Column Settings button, it is located to the right of the Run Query command bar. Hint: This button only appears if there is data from the KQL query.
-
In the Edit column settings blade that appears, within Columns select Operations Count (Heatmap + Formatted).
-
Review the settings, in particular the options for Column renderer. For Color palette, select 32-color categorical.
-
Within Columns, select Trend (Spark line + Formatted).
-
Review the settings, for Column renderer select Spark area and then select a color of your choice in Color palette.
-
Select Save and Close. Now we are going to review how one tile/grid control can be used to filter the results in another tile/grid.
-
Select the Advanced Settings button in command bar of the Editing query item: query - 2.
-
Review the When items are selected, export parameters setting. Notice the UserInfo field is selected.
-
Scroll down and select Done Editing at the bottom of the query (not the top menu). Look at the changed colors for Operations count and Trend.
-
Select Edit below the Top active users pie chart on the right side of the screen.
-
In the Logs query, locate UserInfo. The query is using the parameter exported from the other query to filter results.
-
Scroll down and select Done Editing at the bottom of the query (not the top menu).
-
Scroll up and select Done Editing at the top menu and select the Save icon. Close the workbook by selecting the X in the top-right corner.
Task 3: Create a Workbook
In this task, you will create a new workbook with advanced visualizations.
-
You should be back at the Workbooks area of the Microsoft Sentinel portal.
-
Select + Add workbook to create a new workbook from scratch.
Note: Although it is a new workbook, a startup template is used.
-
To edit the workbook, select Edit.
-
Select the Edit button below the first paragraph of the workbook.
-
Type # My workbook in a new line on top of ## New workbook.
-
Select Done Editing on the bottom menu, for the Editing text item: text - 2. Notice that your header increased size and name changed.
-
Select Edit below the only visible barchart graph.
-
Review the KQL statement that provides a union statement of counts across all tables.
-
Scroll down and select the Done Editing on the bottom menu, for the Editing query item: query - 2.
-
Select the ellipsis … next to the Edit button of the barchart graph, then select + Add, then select Add query.
-
Type SecurityEvent into the query box.
-
Change the Time Range to Last hour.
-
Change the Visualization to Time chart.
-
Select Style from the query’s command bar.
-
Select the Make this item a custom width box.
-
Set the Percent width to 25 and Maximum width to 25.
-
Now select Advanced Settings from the query’s command bar.
-
Select Show refresh icon when not editing box.
-
Scroll down and select Done Editing on the bottom menu, for the new Editing query item: query - 2.
-
Scroll down and at the bottom of the workbook select + Add, then Add query.
-
Type SecurityEvent into the query box.
-
Change the Time Range to Last hour.
-
Change the Visualization to Grid.
-
Select Style from the query’s command bar.
-
Select Make this item a custom width box.
-
Set the Percent width to 75 and Maximum width to 75.
-
Scroll down and select Done Editing on the bottom menu, for the new Editing query item: query - 3.
-
Select Done Editing in Workbook’s top command bar.
-
Select the Save icon, change the Title to My Workbook.
-
Select the RG-Defender resource group if needed and leave other values as default.
-
Select Apply to commit the changes.
-
Close the workbook by selecting the X at the top-right or select Workbooks in the Microsoft Sentinel portal.
-
Back in the Workbooks page, select the My workbooks tab.
-
Select the workbook you just created, My workbook.
-
On the right pane, select View saved workbook to review your workbook.