Before Lab 4.7 — Dashboards and Operational Readiness

Workbooks use parameters to make your dashboards interactive. Change a parameter value once, and it updates every tile and query in the workbook.

---

Workbooks vs. dashboards

Azure has two types of dashboards:

Feature	Azure Dashboard	Sentinel Workbook
Purpose	General overview of resources	Security-specific analysis
Content	Charts, links, metrics	KQL-driven queries, custom visualisations
Customisation	Limited (drag-and-drop tiles)	Full (custom KQL queries, dynamic parameters)
Sharing	Shared across Azure portal	Shared within Sentinel workspace
Interactivity	Static charts	Interactive charts with filters and drill-down

Sentinel workbooks are the preferred tool for security monitoring because they are driven by KQL queries and can be deeply customised.

---

Built-in Sentinel workbooks

Sentinel includes several built-in workbooks for common security monitoring scenarios. In the Sentinel workspace, navigate to Workbooks → Built-in to explore available templates.

Some built-in workbooks cover:

• Incident analysis — views of incident severity, status, and MITRE ATT&CK coverage
• Data connector status — which connectors are active and how recent their data is
• Defender for Cloud recommendations — security findings by severity and category
• Investigation utilities — tools for tracing activity across tables

Built-in workbooks are a great starting point; you can customise them or fork them for your own use.

---

Workbook structure

A workbook consists of sections, each containing one or more tiles:

Creating a custom tile

Each tile in a workbook is driven by a KQL query:

1. Add a new tile to the workbook
2. Write a KQL query that returns the data to visualise
3. Choose a visualisation type (table, chart, single value, card)
4. Configure the query parameters (time range, filters)
5. Save the workbook

Common visualisation types in Sentinel

Sentinel workbooks support several visualisation types, each suited to different security analysis needs:

• Table — Detailed list of events (e.g., incidents with severity and status)
• Chart — Trends over time or comparisons between categories
• Single value — Key metric at a glance (e.g., current active incident count)
• Card — Status indicator for quick scanning

---

Workbook parameters

Workbooks can include parameters that make them interactive:

Parameter	Type	Example
Resource group	Dropdown	rg-devops-mmommers-dev
Time range	Dropdown	Last hour, last 6 hours, last 24 hours
Severity	Multi-select	High, Medium, Low
IP address	Text input	203.0.113.5

Parameters allow the same workbook to be reused for different investigations without modifying the query.

Parameter in KQL

In a workbook, you define parameters in the parameter panel, then reference them in KQL using the param() function:

// Reference a workbook parameter (default: "10.0.0.1" if none supplied)
let selectedIp = param("TargetIP", "10.0.0.1");

requests
| where clientIp_s == selectedIp
| summarize count() by name
| order by count_ desc

• param("TargetIP") — reads the value of the TargetIP parameter from the workbook UI.
• param("TargetIP", "10.0.0.1") — same as above, but falls back to "10.0.0.1" when the parameter has no value.
• String columns in Log Analytics carry a _s suffix (e.g., clientIp_s).

---

Monitoring coverage

Monitoring coverage is the final check: after enabling all data sources and detection rules, you need to verify that everything is working and identify any gaps in your monitoring.

What to check

Data Source	Expected Table	Status	Action if Missing
App Service HTTP logs	AzureDiagnostics (AppServiceHTTPLogs)		Check diagnostic settings
App Service console logs	AppServiceLogs		Check diagnostic settings
SDK requests	AppRequests		Check SDK is initialised
SDK dependencies	AppDependencies		Check SDK is initialised
Key Vault audit events	AzureDiagnostics (AuditEvent)		Check diagnostic settings
Storage access logs	AzureDiagnostics (Transaction)		Check diagnostic settings
Azure Activity Log	AzureActivity		Check connector is enabled
Defender for Cloud alerts	SecurityAlert		Check Defender tier
Azure DevOps audit logs	AzureDevOpsAuditing		Check streaming is configured

Common coverage gaps

If any table is missing or empty:

Gap	Possible Cause	Fix
AppRequests is empty	SDK not initialised	Check index.ts has useAzureMonitor() call
AzureDiagnostics is empty	Diagnostic settings not enabled	Enable in portal or fix Terraform
AzureActivity is empty	Connector not enabled	Enable in Sentinel portal
AuditEvent is empty	Key Vault has no recent operations	Trigger a Key Vault operation
AzureDevOpsAuditing is empty	Audit streaming not configured	Set up Azure DevOps audit stream in Organisation settings

The Day 4 monitoring stack includes nine data sources across all labs (the addition of Azure DevOps audit logging in Lab 4.6 brings the total from eight to nine). Your coverage review should confirm all nine are active before declaring the monitoring stack ready for production.

---

Operational readiness

Operational readiness means your monitoring stack is ready to detect and respond to security events:

Readiness Check	How to verify
Data is flowing	Query Log Analytics — tables have recent data
Analytics rules are active	Sentinel shows rules with "Active" status
Data connectors are configured	Sentinel data connector page shows "Enabled"
Dashboards are built	Workbooks show current data
Alerting is configured	Test a detection rule and verify incident is created
Team is trained	Analysts can run queries and investigate incidents

---

Lab 4.7 objectives

Lab 4.7 goals

• Browse built-in Sentinel workbooks and understand their content
• Create a custom workbook tile with a KQL query
• Review the monitoring stack and identify any gaps
• Understand how to share workbooks with team members

Key questions before starting

1. What is the difference between an Azure dashboard and a Sentinel workbook?
2. Why are workbooks driven by KQL queries instead of static charts?
3. How do workbook parameters make a dashboard more useful?
4. If a workbook tile shows no data, what could be the cause?

---

References

• Workbook parameters