Microsoft Sentinel Workbooks and Custom Dashboards – SC-200 Study Guide

Purpose of This Lesson

This lesson explains how Microsoft Sentinel workbooks are used to visualize security data, review trends, and build interactive dashboards for SOC monitoring. For the SC-200 exam, you need to understand that workbooks are not detection rules, incidents, or automated response tools. They are primarily used for visual analysis, reporting, dashboarding, and operational monitoring.

In a real SOC, a security operations analyst may use workbooks to monitor sign-in activity, audit events, role changes, cloud provider activity, Microsoft 365 activity, or trends across connected data sources. Workbooks help analysts move from raw logs to useful visual summaries.

Microsoft Sentinel workbooks are based on Azure Monitor workbooks and can use tables, charts, and KQL queries to visualize data collected in Sentinel. Microsoft also provides built-in workbook templates that can be used after connecting the relevant data sources.

Key Concepts

What Are Microsoft Sentinel Workbooks?

A workbook in Microsoft Sentinel is an interactive visual report or dashboard. It helps analysts view and explore security data without needing to manually run raw queries every time.

Workbooks can display data as:

• Tables
• Charts
• Grids
• Tiles
• Time charts
• Donut charts
• Bar charts
• Text sections
• Interactive filters
• Query-driven visualizations

The key idea is simple: workbooks help you visualize data that already exists in Sentinel.

A workbook does not collect data by itself. Sentinel must already be ingesting the relevant logs from a connected data source. For example, an Azure AD / Microsoft Entra ID sign-in workbook only becomes useful if sign-in logs are being collected.

Workbooks Depend on Data Sources

Sentinel workbooks are only as useful as the data behind them. If the relevant connector is not enabled, the workbook may appear empty or incomplete.

For example:

Workbook Type	Required Data
Microsoft Entra ID sign-in workbook	Sign-in logs
Microsoft audit logs workbook	Microsoft 365 or audit log data
AWS workbook	AWS activity, CloudTrail, or related AWS data
Defender workbook	Microsoft Defender data ingested into Sentinel

This is an important SC-200 point: workbooks visualize connected data; they do not magically create data.

Microsoft notes that some workbooks require specific data connections before they function correctly, and analysts should check the required data types before saving or using the workbook.

My Workbooks vs Templates

In Microsoft Sentinel, workbooks are commonly viewed in two broad areas:

Area	Meaning
My Workbooks	Workbooks you created, saved, or customized
Templates	Prebuilt workbook templates available from installed content or Microsoft Sentinel solutions

My Workbooks

My Workbooks contains saved workbooks that are available in the workspace. These may be custom dashboards created by analysts, engineers, or security teams.

Examples:

• A custom sign-in monitoring dashboard
• A privileged role change dashboard
• A failed authentication workbook
• A high-risk user activity view
• A cloud workload activity dashboard

Templates

Templates are prebuilt workbooks that Microsoft or solution providers make available. These are useful because they save time and provide a starting point for common monitoring use cases.

For example, instead of building an AWS activity workbook from scratch, you may be able to install a relevant solution from Content Hub and use an existing AWS workbook template.

Sentinel Content Hub and Workbook Templates

The Microsoft Sentinel Content Hub is where you can discover and deploy packaged security content. These solutions may include:

• Data connectors
• Workbooks
• Analytics rules
• Hunting queries
• Automation content
• Playbooks

Microsoft Sentinel solutions provide a consolidated way to acquire content like data connectors, workbooks, analytics, and automation in a workspace through a deployment process.

This matters because many workbook templates are tied to specific solutions. If a workbook template is not available, you may need to install the related solution first.

Example:

If your organization uses AWS, you may install an AWS-related Sentinel solution. After that, AWS workbook templates may appear under Workbooks. Those templates can help visualize AWS network activity, audit logs, or cloud security data, assuming the AWS data connector is configured and logs are being ingested.

Using Workbook Templates

Workbook templates are useful when you want a fast, prebuilt visualization without creating everything from scratch.

A typical workflow is:

1. Go to Microsoft Sentinel.
2. Open Threat management.
3. Select Workbooks.
4. Choose the Templates tab.
5. Find the workbook template you want.
6. View the template.
7. Apply filters such as time range, user, category, or data type.
8. Save a customized copy if needed.

Templates often include built-in filters and visualizations. For example, a Microsoft audit logs workbook may allow you to filter by:

• Time range
• User principal name
• Activity category
• Role management activity
• Audit operation type

This allows an analyst to quickly narrow the workbook to a specific user, category, or time window.

Example: Microsoft Audit Logs Workbook

A Microsoft audit logs workbook can help visualize tenant activity such as:

• Administrative changes
• User activity
• Role management events
• Policy changes
• Configuration updates
• Audit trends over time

For SC-200, understand why this matters: audit logs are often used during investigations involving privilege changes, account compromise, suspicious administrator behavior, or unauthorized configuration changes.

For example, if an alert indicates that a user was added to a privileged role, a workbook could help the analyst visually review related role management activity across the selected time range.

Example: AWS Workbook in Sentinel

The transcript also referenced AWS workbook templates. This is a useful exam and real-world concept because Sentinel is not limited to only Microsoft data.

Microsoft Sentinel can ingest data from third-party and cloud platforms, including AWS, depending on configured connectors and solutions. A workbook can then visualize that data inside the Sentinel experience.

Real-world example:

A company uses Microsoft 365, Azure, and AWS. The SOC wants centralized visibility. Sentinel can ingest AWS logs and use workbooks to display AWS activity alongside Microsoft security data.

This reinforces one of Sentinel’s major SIEM concepts: Sentinel is designed to collect and analyze security data from multiple sources, not just Microsoft products.

Creating a Custom Workbook

A custom workbook allows you to build your own dashboard instead of relying only on templates.

In the transcript, the custom workbook example uses the following workflow:

1. Open security.microsoft.com.
2. Go to Microsoft Sentinel.
3. Open Threat management.
4. Select Workbooks.
5. Choose Add workbook.
6. Select Edit.
7. Add workbook components.
8. Add a query or visualization.
9. Save the workbook with a name, such as Sign-in Data.

The key concept is that a custom workbook gives you control over what data is shown and how it is presented.

Workbook Components

When editing a workbook, you can add different types of content.

Add Text

Text allows you to add Markdown content to the workbook.

Common uses:

• Section headers
• Analyst instructions
• Descriptions
• Notes about data sources
• Triage guidance
• Explanation of workbook logic

Example:

Microsoft Entra ID Sign-in Trends – Last 24 Hours

This helps make the workbook readable for other analysts.

Add Parameters

Parameters are interactive filters. They allow the workbook user to control what data is shown.

Common examples:

• Time range
• User principal name
• IP address
• Device name
• Application name
• Result type
• Subscription
• Resource group

Azure Monitor workbook parameters collect input from workbook users and can be referenced in other workbook sections, usually to scope results or control visual output.

Parameters are important because they make a workbook reusable. Instead of hardcoding one user or one time range into a query, you can let the analyst select values dynamically.

Add Actions

Actions allow you to create interactive buttons or links.

Examples:

• Open an investigation page
• Link to another workbook
• Open a dashboard
• Run a query
• Navigate to an incident view
• Open a user investigation page

Actions can improve SOC workflow by reducing the number of manual clicks required during investigation.

Add Data Source / Visualization

This is one of the most important workbook features. It allows you to add a query and choose how the results should be displayed.

Common visualization options include:

• Grid
• Bar chart
• Time chart
• Donut chart
• Table
• Tiles
• Graphs
• Maps

Azure workbooks support rich visual components such as charts, grids, tiles, trees, stats, graphs, maps, and text visualizations.

This is where KQL becomes important. A workbook can run a KQL query against a Sentinel table and then display the results visually.

Add Image or Video

Images and videos are optional content elements. They are not core to security detection, but they can help with:

• Analyst instructions
• Training dashboards
• Process diagrams
• Embedded documentation
• Internal SOC runbooks

For exam purposes, this is less important than query visualizations and parameters.

Add Group

Groups allow you to organize multiple workbook elements together.

Use groups to:

• Collapse sections
• Organize related charts
• Separate identity, endpoint, email, and cloud sections
• Improve workbook readability

In a large SOC dashboard, groups help prevent visual clutter.

Custom Workbook Example: Sign-in Data

The transcript demonstrates a simple custom workbook that queries sign-in logs.

A basic version would query the SigninLogs table.

Example:

SigninLogs

This returns sign-in log records, assuming the table exists and the data is being ingested.

However, in a real environment, querying an entire table without filters is usually not ideal. It may return too much data, run slowly, or produce noisy results. A better workbook query would normally include a time filter or parameter.

Example:

SigninLogs
| where TimeGenerated > ago(24h)
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, ResultType, ResultDescription
| order by TimeGenerated desc

This example limits the results to the last 24 hours and displays fields that are useful during sign-in review.

Microsoft Security Operations Context

How Workbooks Fit into a SOC Workflow

Workbooks are best understood as visibility and analysis tools. They help analysts see patterns, trends, and summaries across security data.

A SOC analyst might use a workbook to answer questions like:

• Are failed sign-ins increasing?
• Which users are generating the most failed authentication events?
• Are there unusual administrative role changes?
• Which IP addresses are associated with suspicious activity?
• Which AWS accounts are producing high-risk activity?
• Which Microsoft 365 audit events happened during the incident window?
• Are incidents clustered around a specific user, device, or application?

Triage

During alert triage, a workbook can help provide quick context.

Example:

An alert fires for suspicious sign-in behavior. The analyst opens a sign-in workbook and filters by the affected user. The workbook may show:

• Recent sign-in attempts
• Failed vs successful attempts
• Source IP addresses
• Applications accessed
• Geographic trends
• Conditional Access results

This helps the analyst decide whether the alert is likely malicious or a false positive.

Investigation

During investigation, workbooks can help establish a timeline and scope.

Example investigation questions:

• When did suspicious activity begin?
• Was the same user active from multiple IP addresses?
• Did the user access sensitive applications?
• Were role changes made after sign-in?
• Did other users authenticate from the same IP?
• Was the activity isolated or widespread?

Workbooks are especially helpful when combined with KQL queries, incident evidence, entity pages, and hunting queries.

Reviewing Entities

Workbooks can support entity-based investigation by helping visualize activity around:

• Users
• Devices
• IP addresses
• Applications
• Mailboxes
• Cloud resources
• Subscriptions
• AWS accounts
• Microsoft 365 workloads

For example, a workbook parameter can allow an analyst to enter a user principal name and view related sign-in, audit, and role management activity.

Determining Scope and Impact

Workbooks can help determine scope by showing patterns across many records.

Example:

A suspicious IP address is identified. A workbook can help show:

• Which users authenticated from that IP
• Whether sign-ins succeeded or failed
• Which applications were accessed
• Whether the IP appears across multiple tenants, subscriptions, or workloads
• Whether activity increased during a certain time window

This supports better containment decisions.

Containment and Remediation

Workbooks usually do not perform containment directly. They support the decision-making process.

For containment, an analyst may need to use:

• Microsoft Defender XDR response actions
• Microsoft Defender for Endpoint device isolation
• Microsoft Entra ID user risk remediation
• Microsoft Sentinel automation rules
• Microsoft Sentinel playbooks
• Microsoft Defender for Office 365 email remediation
• Microsoft Defender for Cloud recommendations or alerts

A workbook may help justify the action, but it is not usually the action itself.

Escalation

Workbooks can provide useful evidence for escalation.

Example escalation note:

“Reviewed Sentinel sign-in workbook for user jsmith@contoso.com. Activity shows 47 failed sign-ins followed by one successful sign-in from an unfamiliar IP address. The same IP attempted authentication against four additional users. Recommend identity team review user risk, reset password, revoke sessions, and validate Conditional Access enforcement.”

This is the kind of evidence-based escalation that matters in real SOC work.

Improving Future Detection

Workbooks can help identify gaps in detection logic.

For example:

• A workbook shows repeated failed sign-ins but no incident was generated.
• A workbook shows role changes outside business hours.
• A workbook shows suspicious activity from a known risky country.
• A workbook shows high-volume audit events from a service account.

These observations may lead to new:

• Analytics rules
• Hunting queries
• Watchlists
• Automation rules
• Playbooks
• Incident response procedures

Exam-Relevant Takeaways

For the SC-200 exam, remember the following:

• Workbooks are for visualization and monitoring, not alert generation.
• Analytics rules create alerts and incidents from detected conditions.
• Hunting queries are used for proactive threat hunting.
• Automation rules and playbooks are used for response workflows.
• Data connectors are required before relevant data appears in Sentinel.
• Workbook templates are prebuilt dashboards that can be installed or used from Sentinel content.
• Custom workbooks can include text, parameters, actions, queries, visualizations, images, videos, and groups.
• KQL queries power many workbook visualizations.
• Parameters make workbooks interactive and reusable.
• A workbook can visualize Microsoft and non-Microsoft data, such as AWS data, if the data is ingested.
• Workbooks can support triage and investigation, but they are not a replacement for incidents, entity pages, or response actions.

Tool / Feature Decision Guide

Scenario	Best Microsoft Security Tool or Feature	Why
You need to visualize sign-in trends over time	Microsoft Sentinel workbook	Workbooks are designed for interactive dashboards and visual reports
You need to generate an incident when suspicious activity occurs	Microsoft Sentinel analytics rule	Analytics rules evaluate data and create alerts/incidents
You need to proactively search for suspicious activity	Hunting query	Hunting queries are used to investigate threats before or outside alert generation
You need a prebuilt dashboard for AWS activity	Sentinel Content Hub solution + workbook template	Content Hub provides packaged content, including workbook templates
You need to filter a dashboard by user or time range	Workbook parameters	Parameters allow interactive filtering
You need to add explanatory notes to a dashboard	Workbook text element	Text supports headers, instructions, and Markdown explanations
You need to display KQL results as a chart	Workbook query visualization	Query visualizations convert KQL results into visual formats
You need to isolate a compromised endpoint	Microsoft Defender for Endpoint	Workbooks help with visibility, but endpoint response actions happen in Defender for Endpoint
You need to automate incident handling	Sentinel automation rule or playbook	Automation rules and playbooks handle response workflows
You need to monitor audit log role management activity	Microsoft audit logs workbook or custom Sentinel workbook	Workbooks can visualize audit events and role-related activity
You need to document SOC metrics for leadership	Workbook dashboard	Workbooks are useful for operational reporting and trend visibility
You need to correlate events with a high-value asset list	Watchlist + KQL / analytics rule	Watchlists enrich searches, analytics, hunting, and response logic
You need to understand a specific incident’s entities and evidence	Sentinel incident investigation view	Workbooks provide context, but incident investigation tools focus on evidence and entity relationships

KQL Notes

Basic Query Used in the Lesson

The lesson uses a very simple KQL idea: query the sign-in logs table.

Example:

SigninLogs

This returns records from the SigninLogs table.

What This Query Does

Query Part	Meaning
SigninLogs	Queries Microsoft Entra ID sign-in log data ingested into Sentinel

This is useful for demonstration, but it is too broad for most real investigations.

Improved Example: Sign-ins from the Last 24 Hours

SigninLogs
| where TimeGenerated > ago(24h)
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, ResultType, ResultDescription
| order by TimeGenerated desc

Query Logic

Operator	Purpose
where	Filters records to reduce noise
ago(24h)	Looks back over the last 24 hours
project	Selects only the columns you want to display
order by	Sorts results by newest sign-ins first

Why This Helps in a Workbook

This query would be better for a workbook because it limits the output and focuses on useful investigation fields.

A workbook could display this as:

• A grid
• A table
• A time chart
• A user activity view

Example: Failed Sign-ins by User

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize FailedSignIns = count() by UserPrincipalName
| order by FailedSignIns desc

What This Finds

This query identifies users with failed sign-ins during the last 24 hours.

Why It Matters

This can help identify:

• Password spray activity
• Brute-force attempts
• Users with stale credentials
• Misconfigured applications
• Compromised accounts under attack

Workbook Use Case

This could be displayed as a bar chart showing users with the highest number of failed sign-ins.

Example: Sign-ins by IP Address

SigninLogs
| where TimeGenerated > ago(24h)
| summarize SignInCount = count() by IPAddress
| order by SignInCount desc

What This Finds

This summarizes sign-in activity by IP address.

Workbook Use Case

This can help analysts quickly identify IP addresses generating large amounts of authentication activity.

Exam Expectations for KQL in Workbooks

For SC-200, you should understand:

• KQL queries can be used inside workbook visualizations.
• Filtering with where reduces noise.
• summarize aggregates data for charts.
• project controls which fields are displayed.
• order by sorts results.
• Time filtering is important for performance and relevance.
• Workbook parameters can make queries reusable.

Common Exam Traps

Trap 1: Confusing Workbooks with Analytics Rules

A workbook visualizes data. It does not create incidents by itself.

If the question asks how to detect suspicious activity and generate an incident, the answer is likely analytics rule, not workbook.

Trap 2: Confusing Workbooks with Hunting Queries

A hunting query is used to proactively search for threats. A workbook can display query results, but the purpose is different.

If the question asks for proactive investigation, choose hunting.

If the question asks for dashboard visualization, choose workbook.

Trap 3: Forgetting Data Connectors

If a workbook is blank, the likely issue may be that the required data source is not connected or data is not being ingested.

Do not assume a workbook template automatically brings in data.

Trap 4: Choosing a Workbook for Response Actions

Workbooks support analysis, but they are not the primary tool for containment.

For response, think:

• Defender for Endpoint for device response
• Defender for Office 365 for email remediation
• Microsoft Entra ID for identity actions
• Sentinel automation rules and playbooks for automated workflows

Trap 5: Using Broad KQL Queries Without Filters

A query like this may work in a lab:

SigninLogs

But in production, it is usually too broad.

A better query includes:

• Time filters
• User filters
• Result filters
• Projection of useful columns
• Aggregation when building charts

Trap 6: Assuming Templates Are Always Installed

Some workbook templates come from installed solutions. If the template is missing, the related Sentinel solution or standalone content may need to be installed from Content Hub.

Trap 7: Assuming Sentinel Only Works with Microsoft Data

Sentinel can ingest non-Microsoft data, including AWS data, when configured properly. This matters in hybrid and multicloud environments.

Real-World SOC Analyst Notes

Workbooks Reduce Investigation Friction

A good workbook saves analysts from repeatedly writing the same queries. For example, instead of manually querying sign-ins every time an identity alert appears, a SOC team can build a sign-in investigation workbook with parameters for:

• User principal name
• Time range
• IP address
• Application
• Result type

This creates a repeatable investigation workflow.

Workbooks Help With Alert Fatigue

Workbooks can help analysts see whether an alert is part of a larger trend or just isolated noise.

Example:

A single failed sign-in alert may not be serious. But if a workbook shows hundreds of failed sign-ins across multiple accounts from the same IP address, the activity may indicate password spray.

Workbooks Improve Evidence Quality

A workbook can help analysts document findings with visual evidence:

• Screenshots of trends
• Tables of affected users
• Counts of failed sign-ins
• Timeline of activity
• Audit activity summaries

This is useful for escalation, incident reports, and after-action reviews.

Be Careful With Automation Assumptions

A workbook may show suspicious activity, but that does not mean automatic remediation should always occur.

Example:

If a workbook shows many failed sign-ins for an executive account, an analyst may escalate to identity or security engineering before taking disruptive action.

Automation should be tested carefully, especially if it can disable accounts, isolate devices, block IPs, or modify tenant-wide settings.

Consider Sentinel Cost and Data Volume

Microsoft Sentinel costs are heavily influenced by data ingestion and retention. Workbooks themselves are visualization tools, but the data they query must exist in the workspace.

Operational considerations:

• Avoid ingesting unnecessary logs.
• Use filtering where possible.
• Be careful with high-volume data sources.
• Use appropriate retention policies.
• Avoid workbook queries that scan excessive data without time filters.

Access Permissions Matter

Not every analyst should be able to edit shared workbooks. In production environments, workbook permissions should align with job responsibilities.

Microsoft states that each workbook is an Azure resource and can be assigned Azure role-based access control to define and limit access.

Common permission model:

• Tier 1 analysts: read/use workbooks
• Tier 2/Tier 3 analysts: create or modify investigation workbooks
• Security engineers: manage shared production dashboards
• SOC managers: review metrics dashboards

Dashboard Design Matters

A workbook should answer specific operational questions. Avoid building dashboards that show everything but clarify nothing.

Good workbook design:

• Clear title
• Useful filters
• Time range control
• Focused sections
• Limited noise
• Actionable columns
• Links to investigation views
• Consistent naming
• Documentation text

Poor workbook design:

• Too many charts
• No filters
• No explanation
• Queries scanning too much data
• Visuals that do not support decisions
• No clear investigation flow

Quick Reference Summary

• Microsoft Sentinel workbooks are used for visualization and monitoring.
• Workbooks can be created from templates or built manually.
• Templates may come from Content Hub solutions.
• Workbooks depend on connected and ingested data sources.
• Custom workbooks can include text, parameters, actions, queries, images, videos, and groups.
• KQL queries can power workbook visualizations.
• Parameters make dashboards interactive.
• Workbooks are useful for SOC triage, investigation, trend analysis, and reporting.
• Workbooks do not create alerts or incidents by themselves.
• Use analytics rules for detection.
• Use hunting queries for proactive searching.
• Use automation rules and playbooks for response workflows.
• Use Defender products for workload-specific remediation actions.
• Always filter workbook queries by time range or relevant fields in production.

Flashcards

Q: What is the main purpose of Microsoft Sentinel workbooks?
A: To visualize and monitor security data through interactive reports and dashboards.

Q: Do workbooks generate incidents in Microsoft Sentinel?
A: No. Analytics rules generate alerts and incidents. Workbooks visualize data.

Q: Where can prebuilt Sentinel workbook templates come from?
A: They can come from installed solutions or standalone content in the Microsoft Sentinel Content Hub.

Q: What must be configured before a workbook can display useful data?
A: The relevant data connector must be enabled and the required data must be ingested into Sentinel.

Q: What is the difference between My Workbooks and Templates?
A: My Workbooks contains saved or customized workbooks, while Templates contains prebuilt workbook designs.

Q: What workbook feature allows users to filter by time range or user?
A: Parameters.

Q: What workbook component is used to add Markdown headers or instructions?
A: Add Text.

Q: What workbook component allows KQL results to be shown as charts or tables?
A: Add Data Source / Visualization, often through a query control.

Q: Which KQL table would commonly be used for Microsoft Entra ID sign-in activity?
A: SigninLogs.

Q: Why should broad workbook queries be avoided in production?
A: They may return too much data, increase noise, reduce performance, and make investigations harder.

Q: When should you use an analytics rule instead of a workbook?
A: When you need to detect suspicious activity and generate alerts or incidents.

Q: When should you use a hunting query instead of a workbook?
A: When proactively searching for threats across data sources.

Q: Can Sentinel workbooks visualize AWS data?
A: Yes, if AWS data is connected and ingested into Sentinel.

Q: What feature should be used for automated response in Sentinel?
A: Automation rules and playbooks.

Q: Why are workbook templates useful for SOC teams?
A: They provide prebuilt visualizations that reduce setup time and help analysts quickly review common security data.

Practice Questions

Question 1:

A SOC analyst wants to create a dashboard showing failed Microsoft Entra ID sign-ins by user over the last 24 hours. The dashboard should allow analysts to adjust the time range interactively. What should the analyst use?

A. Microsoft Sentinel workbook with a time range parameter
B. Microsoft Sentinel analytics rule
C. Microsoft Defender for Endpoint device timeline
D. Microsoft Sentinel incident graph

Correct Answer:
A. Microsoft Sentinel workbook with a time range parameter

Explanation:
Workbooks are used for dashboards and visualizations. A time range parameter allows analysts to interactively control the time window shown in the workbook.

Question 2:

A Microsoft Sentinel workbook template appears blank after being opened. What is the most likely cause?

A. The workbook cannot display Microsoft security data
B. The required data source is not connected or data is not being ingested
C. The workbook must be converted into an analytics rule
D. The workbook must be run from Microsoft Defender for Endpoint

Correct Answer:
B. The required data source is not connected or data is not being ingested

Explanation:
Workbooks visualize data that already exists in Sentinel. If the necessary connector is not enabled or the required logs are not present, the workbook may not show useful results.

Question 3:

You need Microsoft Sentinel to create an incident when suspicious authentication behavior is detected. Which feature should you configure?

A. Workbook
B. Analytics rule
C. Workbook parameter
D. Content Hub dashboard

Correct Answer:
B. Analytics rule

Explanation:
Analytics rules evaluate data and generate alerts or incidents. Workbooks are for visualization and monitoring, not detection logic.

Question 4:

A SOC team wants to use a prebuilt workbook for AWS activity in Microsoft Sentinel. What should they do first?

A. Create a Defender for Endpoint onboarding package
B. Install or configure the relevant Sentinel solution/content and ensure AWS data is ingested
C. Create a Microsoft Entra Conditional Access policy
D. Enable device isolation

Correct Answer:
B. Install or configure the relevant Sentinel solution/content and ensure AWS data is ingested

Explanation:
AWS workbook templates require the relevant Sentinel content and AWS data ingestion. Without the data source, the workbook has little or nothing to visualize.

Question 5:

An analyst creates the following workbook query:

SigninLogs

Why is this not ideal for a production workbook?

A. SigninLogs cannot be used in Microsoft Sentinel
B. Workbooks do not support KQL
C. The query is too broad and lacks filters such as time range or user
D. The query automatically disables user accounts

Correct Answer:
C. The query is too broad and lacks filters such as time range or user

Explanation:
The query may work in a lab, but production workbooks should normally include time filters, field selection, and other constraints to reduce noise and improve performance.