Drill down in azure sentinel workbook

Question

In Splunk, we have the drill-down option in the dashboard so is that possible in azure sentinel workbook? consider I have one chart(tile or piechart) so when I click on that I want to open another tab with specific kql, visualization and dynamic parameters. Is it possible in azure sentinel workbook?

Answer 1

I did some more playing around and found a kludge that should help. You will still need to click in your step to export the parameters but you can then click on a button (or link) to take you to the new tab.

First, create a new parameter that matches the name of the parameters your tab uses. You must go into the "Advanced Settings" tab when creating the parameter and select the "Treat this parameter as global" checkbox.

Then, create a button or link that has its "Action" parameter set to "Set a parameter value" with the "Value" field set to the parameter from the first step and set the "Settings" to whatever value the tab you want to go to requires.

Now when you click on that button, you will taken to the correct tab. Just use the parameters your bar/pie chart exposes. You could take this a bit further and keep the button from step 2 hidden until you set a parameter from the pie/bar chart to make sure you don't click it accidently.

Hope this helps!