Wouldn't it be awesome to take data from various related Microsoft Sentinel Workbooks and display it inline without having to exist the current view or open another browser tab to view them side-by-side? Workbook within a Workbook You can by using the Custom View Link Action in Workbook editing. To do this... [1] Because the … Continue reading How to Open Another Workbook Inside an Existing Microsoft Sentinel Workbook →

Someone asked a great question today about what exactly marking a Threat Indicator in the Threat Intelligence blade in Microsoft Sentinel does. We don't currently have a good explanation in the docs, so I'll add an explanation here and submit it for inclusion in the docs. When you edit a Threat Indicator in Microsoft Sentinel … Continue reading The Revoke Action for Threat Indicators in Microsoft Sentinel →

Microsoft Sentinel customers have had the capability to organize Threat Indicators through tagging. Tagging indicators But now the ability to modify any Threat indicator is possible. For any indicator provided by Microsoft Sentinel, all fields are editable. For partner indicators, only specific fields are editable such as the tags, Expiration date, Confidence, and Revoked fields. … Continue reading How to Edit Threat Indicators in Microsoft Sentinel →