Skip to content

Commit 231d650

Browse files
committed
Remove Incident Overview workbook from solution
The Incident Overview workbook has been removed from the solution package and related metadata. Updated UI definition, ARM template, and documentation to reflect only three workbooks. Solution version incremented to 3.0.7.
1 parent bd1ac18 commit 231d650

File tree

5 files changed

+45
-175
lines changed

5 files changed

+45
-175
lines changed

Solutions/SentinelSOARessentials/Data/Solution_SentinelSOAREssentials.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
],
3131
"Workbooks": [
3232
"Workbooks/AutomationHealth.json",
33-
"Workbooks/IncidentOverview.json",
3433
"Workbooks/SecurityOperationsEfficiency.json",
3534
"Workbooks/IncidentTasksWorkbook.json"
3635
],
77.9 KB
Binary file not shown.

Solutions/SentinelSOARessentials/Package/createUiDefinition.json

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"config": {
77
"isWizard": false,
88
"basics": {
9-
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SentinelSOARessentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel SOAR Essentials solution for Microsoft Sentinel contains Playbooks that can help you get started with basic notification and orchestration scenarios for common use cases. These include Playbooks for sending notifications over email and/or collaboration platforms such as MS Teams, Slack, etc.\n\n**Workbooks:** 4, **Playbooks:** 23\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
9+
"description": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\"width=\"75px\"height=\"75px\">\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SentinelSOARessentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Microsoft Sentinel SOAR Essentials solution for Microsoft Sentinel contains Playbooks that can help you get started with basic notification and orchestration scenarios for common use cases. These include Playbooks for sending notifications over email and/or collaboration platforms such as MS Teams, Slack, etc.\n\n**Workbooks:** 3, **Playbooks:** 23\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
1010
"subscription": {
1111
"resourceProviders": [
1212
"Microsoft.OperationsManagement/solutions",
@@ -94,24 +94,10 @@
9494
{
9595
"name": "workbook2",
9696
"type": "Microsoft.Common.Section",
97-
"label": "Incident overview",
98-
"elements": [
99-
{
100-
"name": "workbook2-text",
101-
"type": "Microsoft.Common.TextBlock",
102-
"options": {
103-
"text": "The Incident Overview workbook is designed to assist in triaging and investigation by providing in-depth information about the incident, including:\r\n* General information\r\n* Entity data\r\n* Triage time (time between incident creation and first response)\r\n* Mitigation time (time between incident creation and closing)\r\n* Comments\r\n\r\nCustomize this workbook by saving and editing it. \r\nYou can reach this workbook template from the incidents panel as well. Once you have customized it, the link from the incident panel will open the customized workbook instead of the template.\r\n"
104-
}
105-
}
106-
]
107-
},
108-
{
109-
"name": "workbook3",
110-
"type": "Microsoft.Common.Section",
11197
"label": "Security Operations Efficiency",
11298
"elements": [
11399
{
114-
"name": "workbook3-text",
100+
"name": "workbook2-text",
115101
"type": "Microsoft.Common.TextBlock",
116102
"options": {
117103
"text": "Security operations center managers can view overall efficiency metrics and measures regarding the performance of their team. They can find operations by multiple indicators over time including severity, MITRE tactics, mean time to triage, mean time to resolve and more. The SOC manager can develop a picture of the performance in both general and specific areas over time and use it to improve efficiency."
@@ -120,12 +106,12 @@
120106
]
121107
},
122108
{
123-
"name": "workbook4",
109+
"name": "workbook3",
124110
"type": "Microsoft.Common.Section",
125111
"label": "Incident Tasks Workbook",
126112
"elements": [
127113
{
128-
"name": "workbook4-text",
114+
"name": "workbook3-text",
129115
"type": "Microsoft.Common.TextBlock",
130116
"options": {
131117
"text": "Use this workbook to review and modify existing incidents with tasks. This workbook provides views that higlight incident tasks that are open, closed, or deleted, as well as incidents with tasks that are either owned or unassigned. The workbook also provides SOC metrics around incident task performance, such as percentage of incidents without tasks, average time to close tasks, and more."

0 commit comments

Comments
 (0)