Azure Sentinel Workbooks (Dashboad) - distinct when chosen from the drop down

Alon Keilin 141 Reputation points

Hi team,

I am preparing a dashboard that is built from 2 filters: the name of the application and the name of the user. 

Is there a way to make it so when I select a user it will "distinct" all the applications related to that user? 

And when I choose an application, will it make a "distinct" for all users who use the application?


Microsoft Graph Workbooks API
Microsoft Graph Workbooks API
A Microsoft API that allows web and mobile applications to read and modify Excel workbooks stored in OneDrive for Business, SharePoint site or Group drive.
61 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
653 questions
No comments
{count} votes

Accepted answer
  1. Clive Watson 2,191 Reputation points MVP

    You can use Distinct

    so add a last line, like

    | distinct ApplicationName

    However in your case you may need to summarize the resuklts

    | summarize by ApplicationName, UserPrincipalName

    Also check that {UserName:lable} is correct, :label is the normal spelling - some workbook templates had this incorrect and the copies of those were also wrong .

    | summarize make_set( AppDisplayName) by UserPrincipalName  
    | where UserPrincipalName == '{ name of the user from User drop down}'  
    | mv-expand set_AppDisplayName  
    | project set_AppDisplayName  

0 additional answers

Sort by: Most helpful