capability

Workbooks

Microsoft Sentinel workbooks provide interactive visualization and monitoring dashboards for security data, incidents, connectors, and operational metrics.

capabilitiesCurrent

Relationships

Microsoft Sentinel
Source productproduct SecurityAlert
Related tabletable SecurityIncident
Related tabletable

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Gap	No product-specific PowerShell automation surface is recorded for this capability yet.
REST API	Supported	Reference
Graph	Gap	No supported Microsoft Graph configuration surface is recorded for this capability yet.
ARM	Supported	Reference
Bicep	Supported	Reference
Terraform	Supported	azurermazurerm_application_insights_workbook Reference
GitHub Actions	Supported	Reference
Azure DevOps	Supported	Reference

Related KQL

Track Sentinel incident volume and ownership

Summarize Sentinel incidents by severity, status, owner, and day for SOC handoff and workbook reporting.

workbook dashboard

beginnersentinel-operationsoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: SecurityIncident

kql

SecurityIncident
| where TimeGenerated > ago({lookback})
| summarize Incidents=dcount(IncidentNumber), Latest=max(TimeGenerated) by bin(TimeGenerated, 1d), Severity, Status, Owner
| order by TimeGenerated desc, Incidents desc

Source: KQLMSPress/definitive-guide-kql Chapter 2: Data Aggregation/Query Samples. Adapted from aggregation and operational dashboard patterns for Sentinel incident operations.

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.