View and analyze Microsoft Sentinel data using workbooks

Viewing and analyzing data within Microsoft Sentinel is a core part of the functionality provided to Security Operations Analysts, especially the ones preparing to pass the SC-200 Microsoft Security Operations Analyst certification. Microsoft Sentinel is a scalable, cloud-native SIEM (Security Information Event Management) and SOAR (Security Orchestration Automated Response) solution that provides intelligent security analytics at cloud scale for enterprises of all sizes and workloads.

Workbooks in Microsoft Sentinel

Workbooks are powerful tools within Microsoft Sentinel that provide custom dashboards to visualize data, allowing analysts to create rich interactive reports. These workbooks are based on KQL (Kusto Query Language) and are designed to help explore and monitor the data that Sentinel collects. They are customizable and can be shared across the team for better collaboration.

Getting Started with Workbooks

To get started with workbooks:

1. Navigate to the Microsoft Sentinel instance in the Azure portal.
2. In the navigation menu, select ‘Workbooks’ to view the gallery of templates.
3. Choose a workbook template that suits your needs or create a new one from scratch.

Analyzing Data Using Pre-Built Workbooks

Microsoft Sentinel comes with a number of pre-built workbooks that can be used to analyze data right away. These out-of-the-box templates cover various domains such as:

• Incident Overview: Helps you view and manage incidents within Sentinel.
• User and Entity Behavior Analytics (UEBA): Assists in identifying risky user behavior.
• Threat Intelligence: Used for tracking and analyzing indicators of compromise.
• Azure AD Sign-in Logs: Provides insight into sign-in patterns and potential identity threats.

Custom Workbooks

Creating custom workbooks allows analysts to dig deeper into the data and tailor the dashboard to their organization’s specific needs. To create a custom workbook:

1. Click on ‘+ New workbook’ in the workbooks gallery.
2. Start with an empty report or use a template as a starting point.
3. Use KQL to query the data you’re interested in.
4. Add visualizations such as charts, tables, and timelines to build your report.

Example Workbook

Here’s a simple example of a custom workbook that an analyst might use to analyze security alerts:

Query:

SecurityAlert
| where TimeGenerated > ago(30d)
| summarize AlertCount = count() by AlertSeverity, bin(TimeGenerated, 1d)
| order by TimeGenerated desc

Visualization:

You could visualize this data in a line chart or a bar chart to display the trend of alerts over the last 30 days, grouped by severity.

Sharing and Collaboration

Workbooks in Microsoft Sentinel can be shared with other team members for collaboration purposes. To share a workbook:

1. Open the desired workbook.
2. Click on the ‘Share’ button.
3. Choose whether to share with specific people or with a larger audience within your organization.

Comparing Data Sources

Workbooks are particularly useful for comparing data from different sources. For example, you might want to compare sign-in logs from Azure AD with alerts generated from your firewall by using a side-by-side comparison within a single workbook.

Comparison Table Example:

Conclusion

Microsoft Sentinel workbooks are fundamental in performing thorough data analysis and gaining actionable insights for security analysts. By using both the pre-built and custom workbook capabilities within Sentinel, security teams can dramatically improve the efficiency and effectiveness of their security operations.

Security analysts who are studying for the SC-200 certification should become familiar with creating, customizing, and utilizing workbooks as they are an integral part of incident response and investigation.

Leveraging the power of Sentinel’s workbooks allows analysts to represent complex datasets in a consumable format, helping to identify trends, anomalies, and patterns critical for an organization’s cybersecurity posture.