Drill down in azure sentinel workbook

Rushit Ajudiya 146 Reputation points
2022-04-21T09:34:13.513+00:00

In Splunk, we have the drill-down option in the dashboard so is that possible in azure sentinel workbook? consider I have one chart(tile or piechart) so when I click on that I want to open another tab with specific kql, visualization and dynamic parameters. Is it possible in azure sentinel workbook?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,048 questions
0 comments No comments
{count} votes

Accepted answer
  1. Gary Bushey 176 Reputation points
    2022-04-21T12:22:51.343+00:00

    I did some more playing around and found a kludge that should help. You will still need to click in your step to export the parameters but you can then click on a button (or link) to take you to the new tab.

    First, create a new parameter that matches the name of the parameters your tab uses. You must go into the "Advanced Settings" tab when creating the parameter and select the "Treat this parameter as global" checkbox.

    Then, create a button or link that has its "Action" parameter set to "Set a parameter value" with the "Value" field set to the parameter from the first step and set the "Settings" to whatever value the tab you want to go to requires.

    Now when you click on that button, you will taken to the correct tab. Just use the parameters your bar/pie chart exposes. You could take this a bit further and keep the button from step 2 hidden until you set a parameter from the pie/bar chart to make sure you don't click it accidently.

    Hope this helps!

    2 people found this answer helpful.

0 additional answers

Sort by: Most helpful