L13. Workbooks and Threat Hunting

Workbooks

Sentinel workbooks are interactive dashboards built on Azure Monitor Workbooks. They visualize security data using KQL queries and support:

• Time range selectors and parameter dropdowns
• Charts, tables, grids, and heatmaps
• Drill-down from summary to detail views
• Cross-resource queries (multiple workspaces)

Common built-in workbooks:

Creating Custom Workbooks

Custom workbooks let you build visualizations specific to your environment:

1. Navigate to Sentinel > Workbooks > Add workbook
2. Add a query step with your KQL query
3. Choose a visualization type (bar chart, pie chart, grid, tile)
4. Add parameters for interactivity (time range, subscription, workspace)
5. Save and pin to your dashboard

Threat Hunting

Threat hunting is proactive search for threats that evade existing detections. Sentinel provides a dedicated Hunting blade with:

• Built-in hunting queries: Pre-built queries organized by MITRE ATT&CK tactic
• Custom queries: Your own KQL-based hunting queries
• Livestream: Real-time query monitoring that alerts when results appear
• Bookmarks: Save interesting results as evidence (attachable to incidents)

The Hunting Workflow

1. Hypothesis: Form a hypothesis based on threat intelligence, industry reports, or anomalies
2. Query: Run hunting queries against relevant data tables
3. Analyze: Review results for true suspicious activity
4. Bookmark: Save interesting findings as bookmarks
5. Escalate: Create an incident from bookmarks or attach to existing incidents
6. Improve: Convert validated hunting queries into analytics rules for future detection

Livestream

Livestream runs a KQL query continuously and generates notifications when results appear. Use it for:

• Monitoring a specific threat indicator during an active incident
• Watching for a particular attack pattern in real time
• Tracking user activity during an investigation

Livestream sessions run for up to 30 days and can send notifications to the Sentinel portal.

Notebooks

Sentinel notebooks use Jupyter Notebooks integrated with Azure Machine Learning for advanced investigation:

• MSTICPy library: Microsoft's Python library for security investigation with functions for enrichment, visualization, and analysis
• Pre-built notebooks: Available in the Content Hub for common investigation scenarios
• Custom notebooks: Build your own using Python, KQL, and the Microsoft Graph API

Notebooks are used for:

• Complex data analysis requiring Python libraries
• Machine learning-based anomaly detection
• Automated report generation
• Advanced threat intelligence correlation

MITRE ATT&CK Coverage

The MITRE ATT&CK blade in Sentinel shows which tactics and techniques your analytics rules and hunting queries cover. Use it to identify detection gaps and prioritize new rule development.