Create and Configure Microsoft Sentinel Workbooks

• A workbook visualizes and monitors; it never detects or responds on its own
• A workbook is composed of parameter, text, and query items
• Activate a template, then customize the saved copy, rather than starting blank
• A template is read-only; only the saved copy is editable
• Templates arrive bundled in Content hub solutions, not standalone
• A saved workbook is governed by Azure RBAC on where you save it
• Each query item pairs one KQL query with one visualization
• The Visualization dropdown overrides the KQL render operator
• Workbooks can query many data sources, not only Log Analytics
• Match the visualization to the shape of the KQL result
• The grid supports column renderers for heatmaps, thresholds, bars, and links
• A parameter referenced as {Name} substitutes into the queries below it
• Use one TimeRange parameter so a single picker rescopes every query
• A dropdown parameter can be data-driven from a KQL query
• Drill-downs pass a clicked value into a parameter on a target view
• Workbooks are portable JSON you can move and source-control
• Organize long workbooks with groups, tabs, and conditional visibility
• Choose a workbook over a Logs query only when the view is reused
• A saved workbook can be pinned to an Azure dashboard
• render must be the last operator and only injects a Visualization annotation, leaving data unchanged

Unlock with Premium — includes all practice exams and the complete study guide.