Keep track of data during hunting with Microsoft Sentinel

• Applies to:

  Microsoft Sentinel in the Azure portal, Microsoft Sentinel in the Microsoft Defender portal

Threat hunting typically requires reviewing mountains of log data looking for evidence of malicious behavior. During this process, investigators find events that they want to remember, revisit, and analyze as part of validating potential hypotheses and understanding the full story of a compromise.

Hunting bookmarks in Microsoft Sentinel help you by preserving the queries you ran in Microsoft Sentinel - Logs, along with the query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration.

Now you can identify and address gaps in MITRE ATT&CK technique coverage, across all hunting queries, by mapping your custom hunting queries to MITRE ATT&CK techniques.

Investigate more types of entities while hunting with bookmarks, by mapping the full set of entity types and identifiers supported by Microsoft Sentinel Analytics in your custom queries. Use bookmarks to explore the entities returned in hunting query results using entity pages, incidents and the investigation graph. If a bookmark captures results from a hunting query, it automatically inherits the query's MITRE ATT&CK technique and entity mappings.

If you find something that urgently needs to be addressed while hunting in your logs, you can easily create a bookmark and either promote it to an incident or add it to an existing incident. For more information about incidents, see Investigate incidents with Microsoft Sentinel.

If you found something worth bookmarking, but that isn't immediately urgent, you can create a bookmark and then revisit your bookmarked data at any time on the Bookmarks tab of the Hunting pane. You can use filtering and search options to quickly find specific data for your current investigation.

You can visualize your bookmarked data by selecting Investigate from the bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.

Alternatively, you can view your bookmarked data directly in the HuntingBookmark table in your Log Analytics workspace. For example:

Viewing bookmarks from the table enables you to filter, summarize, and join bookmarked data with other data sources, making it easy to look for corroborating evidence.

Note

For information about feature availability in US Government clouds, see the Microsoft Sentinel tables in Cloud feature availability for US Government customers.

Important

Microsoft Sentinel is available as part of the public preview for the unified security operations platform in the Microsoft Defender portal. For more information, see Microsoft Sentinel in the Microsoft Defender portal.

Add a bookmark

Create a bookmark to preserve the queries, results, your observations, and findings.

1. For Microsoft Sentinel in the Azure portal, under Threat management select Hunting.
   For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Threat management > Hunting.

2. Select one of the hunting queries.

3. In the hunting query details, select Run Query.

4. Select View query results. For example:

   

   This action opens the query results in the Logs pane.

5. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.

6. Select Add bookmark:

   

7. On the right, in the Add bookmark pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.

8. Bookmarks can be optionally mapped to MITRE ATT&CK techniques or sub-techniques. MITRE ATT&CK mappings are inherited from mapped values in hunting queries, but you can also create them manually. Select the MITRE ATT&CK tactic associated with the desired technique from the drop-down menu in the Tactics & Techniques section of the Add bookmark pane. The menu expands to show all the MITRE ATT&CK techniques, and you can select multiple techniques and sub-techniques in this menu.

   

9. Now an expanded set of entities can be extracted from bookmarked query results for further investigation. In the Entity mapping section, use the drop-downs to select entity types and identifiers. Then map the column in the query results containing the corresponding identifier. For example:

   

   To view the bookmark in the investigation graph, you must map at least one entity. Entity mappings to account, host, IP, and URL entity types you created are supported, preserving backwards compatibility.

10. Select Save to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.

The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, you select General > Logs from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the Logs pane is opened from other locations, such as directly from Azure Monitor.

View and update bookmarks

Find and update a bookmark from the bookmark tab.

1. For Microsoft Sentinel in the Azure portal, under Threat management select Hunting.
   For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Threat management > Hunting.

2. Select the Bookmarks tab to view the list of bookmarks.

3. Search or filter to find a specific bookmark or bookmarks.

4. Select individual bookmarks to view the bookmark details in the right-hand pane.

5. Make your changes as needed. Your changes are automatically saved.

Exploring bookmarks in the investigation graph

Visualize your bookmarked data by launching the investigation experience in which you can view, investigate, and visually communicate your findings by using an interactive entity-graph diagram and timeline.

1. From the Bookmarks tab, select the bookmark or bookmarks you want to investigate.

2. In the bookmark details, ensure that at least one entity is mapped.

3. Select Investigate to view the bookmark in the investigation graph.

For instructions to use the investigation graph, see Use the investigation graph to deep dive.

Add bookmarks to a new or existing incident

Add bookmarks to an incident from the bookmarks tab on the Hunting page.

1. From the Bookmarks tab, select the bookmark or bookmarks you want to add to an incident.

2. Select Incident actions from the command bar:

   

3. Select either Create new incident or Add to existing incident, as appropriate. Then:

   • For a new incident: Optionally update the details for the incident, and then select Create.
   • For adding a bookmark to an existing incident: Select one incident, and then select Add.

As an alternative to the Incident actions option on the command bar, you can use the context menu (...) for one or more bookmarks to select options to Create new incident, Add to existing incident, and Remove from incident.

To view the bookmark within the incident: Navigate to Microsoft Sentinel > Threat management > Incidents and select the incident with your bookmark. Select View full details, and then select the Bookmarks tab.

View bookmarked data in logs

View bookmarked queries, results, or their history.

1. Select the bookmark from the Hunting > Bookmarks tab.

2. Select the links provided in the details pane:

   • View source query to view the source query in the Logs pane.

   • View bookmark logs to see all bookmark metadata, which includes who made the update, the updated values, and the time the update occurred.

3. View the raw bookmark data for all bookmarks by selecting Bookmark Logs from the command bar on the Hunting > Bookmarks tab:

   

This view shows all your bookmarks with associated metadata. You can use Kusto Query Language (KQL) queries to filter down to the latest version of the specific bookmark you're looking for.

There can be a significant delay (measured in minutes) between the time you create a bookmark and when it's displayed in the Bookmarks tab.

Delete a bookmark

Deleting the bookmark removes the bookmark from the list in the Bookmark tab. The HuntingBookmark table for your Log Analytics workspace continues to contain previous bookmark entries, but the latest entry changes the SoftDelete value to true, making it easy to filter out old bookmarks. Deleting a bookmark doesn't remove any entities from the investigation experience that are associated with other bookmarks or alerts.

To delete a bookmark, complete the following steps.

1. From the Hunting > Bookmarks tab, select the bookmark or bookmarks you want to delete.

2. Right-click, and select the option to delete the bookmarks selected.

Related content

In this article, you learned how to run a hunting investigation using bookmarks in Microsoft Sentinel. To learn more about Microsoft Sentinel, see the following articles:

• Threat hunting with Microsoft Sentinel
• Use notebooks to run automated hunting campaigns
• Threat hunting with Microsoft Sentinel (Training module)