How to Make Your Azure Sentinel Workbooks Even More Interactive with Drilldowns and Downloads

Azure Sentinel Workbooks are designed to be dynamic reporting tools. Based on KQL, the numerous Workbooks included with the product and provided across the web (including our own GitHub repo – aka.ms/ASGitHub) give security teams and security managers a way to create personalized, quick-glance views into the security stance of the organization. I’ve worked with many customers to develop highly custom Workbooks that they, in turn, use as a central, operational dashboards projected on large panoramic displays.

Developing data views in Azure Sentinel Workbooks is an art and there’s many areas of knowledge that can be obtained over time that prove extra valuable. I may eventually have to do a formal series on creating Workbooks.

At their base, the dynamic components of the Workbooks allow security teams to quickly adjust things like specific Log Analytics workspace to monitor, different time ranges of data views, drilling into specific users, accounts, and computers, and much more.

On the surface, the Workbooks are intended to provide a cursory view into the security of the organization and then the security team can begin digging deeper if warranted. To do that, the security team generally needs to jump away from the Workbook and start sifting through the normal means in Azure Sentinel, including running Hunting queries and using the Logs blade tool to start data sampling to locate potential threats exposed by the Workbook.

But, over time, I’ve been asked by many customers if they could use the Workbooks themselves as a direct launching pad to start digging into the data.

Of course, you can! Here’s one method I recommend.

Enabling the External Query Button and Export to Excel Options

There are a couple valuable components that you can add to every visualization in an Azure Sentinel Workbook:

1. External Query Button – adds a button that once clicked, takes the underlying query and automatically runs it in the Logs blade of the Azure Sentinel console.
2. Export to Excel – adds a button that when clicked, downloads the data from the underlying query into an Excel file (export_data.xslx).

These two options are available for each visualized component in the Workbook and have to be enabled per component (you can’t enable them Workbook-wide).

To enable these options, first put the entire Workbook into editing mode by click the Edit button at the top left.

Then, once you locate the specific visualization where you want to add the external options, click the Edit button there.

Once the display changes and exposes the underlying KQL query, click to navigate to the Advanced Settings tab.

On the Advanced Settings tab select the two options for Show open external query button when not editing and Show Export to Excel button when not editing.

After you make the selections, you can save the Workbook and exit editing mode. Now, for that specific visualization you’ll see two new icons display at the top right as shown in the next image.

One last tidbit of a tip…

If you prefer to have more data download to an Excel file than what displays in the visualization in the Workbook, consider also enabling the All Columns option when selecting Export to Excel.

[Want to discuss this further? Hit me up on Twitter or LinkedIn]