Azure Sentinel Workbooks

Azure Sentinel Workbooks

In Azure Sentinel, You can either add a new Workbook or you can use the predefined or inbuild workbooks templates. Let’s deep dive into a complete tutorial on Azure Sentinel Workbooks.

Azure Sentinel Workbooks

Azure Sentinel Workbooks help you to visualize and monitor your data. Not only that, it can also help you to build interactive reports.

You have the option to visualize and monitor your data either using the built-in workbooks template or even the option to create new workbooks.

How to access Azure Sentinel Workbooks

You can find the Azure Sentinel Workbooks using the below quick instruction.

  1. Navigate to the respective Azure Sentinel page.
  2. Click on the Workbooks link from the left side as shown below.
How to access Azure Sentinel Workbooks

How to use the built-in workbooks

  • On the Microsoft Senitel page –> click on the Workbooks link from the left side –> Then click on the Templates tab.
How to use the built-in workbooks
  • Click on the View Template button to see the template.
  • Click on the Save button to edit the template –> Select the location and click ok button on the next pop-up.
How to use the built-in workbooks in Azure Sentinel
  • Now, click on the View Saved Workbooks button.
How to edit workbooks
  • Then click on the Edit button to edit the Workbook template.
How to edit workbooks in Microsoft sentinel

Read: How to create Azure dashboards (Step-by-step guide)

How to create Azure Sentinel Workbooks

  1. To create or add a new Azure Sentinel Workbook, click on the + Add workbook as shown below.
How to create Azure Sentinel Workbooks

2. If you want to edit the workbook, click on the Edit button.

How to edit Azure Sentinel Workbooks

3. Once, you are done with the editing of your workbook, click on the save button.

  • Title: Provide a title for your new workbook.
  • Subscription: Choose your Azure subscription.
  • Resource Group: Select the resource group.
  • Location: Choose the location.

Finally, click on the Save button to save the changes.

How to save Azure Sentinel Workbooks

4. If you want to open another workbook in your same workspace, you can click on the Open button as shown below.

How to open Azure Sentinel workbooks

Then click on the one workbook that you want to open from the list.

How to open Azure Sentinel workbook

How to refresh your Azure Sentinel Workbooks data.

There are two options available for this purpose. You can refresh your Azure Sentinel Workbooks data manually or you can also set the autorefresh option with a specific time interval so that your Azure Sentinel Workbooks data gets refreshed automatically with the specified timeline.

  • To refresh your Azure Sentinel data manually, click on the Refresh button present next to the Save button.
How to refresh Azure Sentinel Workbooks
  • To set the auto-refresh option, Click on the Auto refresh: Off option. Choose the Refresh interval (5 minutes, 10 minutes, etc) –> Then click on the Apply button to save the changes.
How to auto refresh Azure Sentinel Workbooks

How to Print Azure Sentinel Workbooks

To print the Azure Sentinel workbook, More content actions –> Choose the Print Content option.

How to Print Azure Sentinel Workbooks

How to delete Azure Sentinel Workbooks

Now, if you don’t want the workbook anymore and to remove the workbook, you can click on the Delete button.

How to delete Azure Sentinel Workbooks

Then, click on the Yes button to confirm the deletion process on the next pop-up.

How to remove Azure Sentinel Workbooks

You may also like following the below articles

Wrapping Up

In this article, we have discussed a complete tutorial on Azure Sentinel Workbooks. Thanks for reading this article and hope this helps !!!