How to Open Another Workbook Inside an Existing Microsoft Sentinel Workbook

Wouldn’t it be awesome to take data from various related Microsoft Sentinel Workbooks and display it inline without having to exist the current view or open another browser tab to view them side-by-side?

You can by using the Custom View Link Action in Workbook editing.

To do this…

[1] Because the Azure portal is web-based, everything has a unique URL. Start by capturing the URL from the Workbook you want to call from within another Workbook. Just open up the Workbook and copy the URL from your browser’s address bar. Now, save it somewhere (you’ll need it later) temporary like Notepad or OneNote.

[2] Next, in the Workbook you want to add the capability, go into Edit mode and choose to Add a Link.

[3] Take a look at the following image example. This shows the values that need to be set in the Link options. This includes choosing how the button should display (Style dropdown), giving it a name (Link text), choosing the Action (Custom View), enabling the result as a Context Pane (pop-up capability), and assigning the button Style as primary.

[4] With the values set, now click the Configure button. When you enter the Custom View settings pane you’ll see that all form values are empty without any guidance on what to enter. But you don’t need to enter anything! Switch from Form view to the URL view under Get Custom View Settings from, paste the Workbook URL you saved earlier and click Initialize Settings. The form values are extracted and filled in for you!