Building and Visualizing Security Dashboards #

Workbooks in Azure Sentinel serve as powerful tools for visualizing and analyzing security-related data.

  • Drag-and-Drop Interface
  • Predefined Templates
  • Custom Data Queries
  • Time-Series Data
  • Interactivity
  • Sharing and Collaboration

These dynamic reports allow for valuable insights into security posture and incident investigation.

Get Started With Workbooks #

Microsoft offers templates tailored to connectors within Azure Sentinel, streamlining workflow and leveraging pre-designed solutions.

  1. Navigate to Workbooks on the left pane.
  2. Access Templates.
  3. Find Your Desired Workbook.
  4. Save Your Template.
  5. Access Your Template.

These templates simplify the creation of customized reports and visualizations, saving time and maximizing platform capabilities.

Acquiring the ability to create custom reports is an essential skill we should focus on next.

Handcrafted Reporting Workbooks #

Custom workbooks are user-defined reports and visualizations that enable you to tailor your security monitoring and analysis to specific needs and preferences. These workbooks empower you to create detailed insights into security data, track key performance metrics, and investigate incidents that matter most to you.

These workbooks can be designed in JSON and ARM Templates formats.

Create Microsoft's Workbook Templates in Sentinel

  1. Go to Workbooks: Access your Azure Sentinel dashboard and locate the "Workbooks" option in the left pane.
  2. Choose to Create a New Workbook: Instead of using pre-existing templates, click on "Add Workbook."

Edit Microsoft's Custom Workbook in Sentinel

  • Access the Workbook Editor: Click on the "Edit" option to start designing your custom workbook.

The following phase is where you immerse into the coding process. You'll gain access to the developer zone where you can craft your unique insights.

Accessing and Using Microsoft's Workbook Templates in Sentinel

  1. Select a Format: Within the editor, you can choose the format for your custom workbook. For this demonstration, we will use JSON. You can copy the provided JSON code and paste it into your workbook.
  2. Code and Apply Changes: After doing the code, click "Apply" to save your changes.
  3. Finish Editing: Click "Done Editing" when you have completed your customization.
  4. Save Your Workbook: Click on the save icon to store your custom workbook.
  5. Provide Workbook Details: Enter the name of your workbook, select the subscription, resource group, and location as needed.
  6. Finalize and Apply: Once you have configured the details, click "Apply" to create your custom workbook.
  7. View Your Results: Your custom workbook will take effect and produce the desired results, tailored to your specific needs.

Creating custom workbooks allows you to design reports and visualizations that are customized to your organization's unique security and monitoring requirements.

Developers like myself design custom workbooks, my handle is at yaya2devops, and share them on GitHub. You can then adopt, adapt, and confidently present them to your team lead/supervisor as just your own since they really are!

Security Reports Exhibition Center #

Once you've created your workbooks, whether they are built-in or custom, it's time to check them in Microsoft Sentinel. This is where the real power comes to the forefront.

Azure Portal Company Sign-In Activity Overtime

  1. Inspect Your Workbooks: Take a close look at the workbooks you've created, exploring their contents and ensuring they align with your objectives. This step is all about precision and accuracy. Audit bro

  2. Demonstrate Their Value: Showcase the efficacy of your workbooks to your team, highlighting how they provide valuable insights and improve your security and monitoring efforts. Audit bro

  3. Articulate Their Significance: Speak about the impact of your workbooks, explaining how they contribute to better decision-making and a heightened understanding of your organization's security landscape. Audit bro

  4. Facilitate Collaboration: Engage in productive discussions with your team and gather feedback on your workbooks. Collaboration can lead to enhancements and even more effective reporting. Audit bro

  5. Customize and Iterate: If necessary, make further refinements to your workbook.

Based on feedback you receive during this process, refine on KQL and iterate.

Continuous improvement is key.

ꗃ