Wouldn’t it be awesome to take data from various related Microsoft Sentinel Workbooks and display it inline without having to exist the current view or open another browser tab to view them side-by-side?

You can by using the Custom View Link Action in Workbook editing.
To do this…
[1] Because the Azure portal is web-based, everything has a unique URL. Start by capturing the URL from the Workbook you want to call from within another Workbook. Just open up the Workbook and copy the URL from your browser’s address bar. Now, save it somewhere (you’ll need it later) temporary like Notepad or OneNote.
[2] Next, in the Workbook you want to add the capability, go into Edit mode and choose to Add a Link.

[3] Take a look at the following image example. This shows the values that need to be set in the Link options. This includes choosing how the button should display (Style dropdown), giving it a name (Link text), choosing the Action (Custom View), enabling the result as a Context Pane (pop-up capability), and assigning the button Style as primary.
[4] With the values set, now click the Configure button. When you enter the Custom View settings pane you’ll see that all form values are empty without any guidance on what to enter. But you don’t need to enter anything! Switch from Form view to the URL view under Get Custom View Settings from, paste the Workbook URL you saved earlier and click Initialize Settings. The form values are extracted and filled in for you!
Now, when you click your newly created button, the other Workbook will pop-up in a side pane.

=========================
[Want to discuss this further? Hit me up on Twitter or LinkedIn]
[Subscribe to the RSS feed for this blog]
[Subscribe to the Weekly Microsoft Sentinel Newsletter]
[Subscribe to the Bi-Weekly Defender for Cloud Newsletter]
[Learn KQL with the Must Learn KQL series and book]
You must log in to post a comment.