Skip to content

Commit 7e66d3c

Browse files
committed
Add how to view bookmarks in incidents
1 parent bed3512 commit 7e66d3c

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

articles/sentinel/bookmarks.md

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,15 +86,21 @@ Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
8686

8787
1. From the **Bookmarks** tab, select the bookmark or bookmarks you want to add to an incident.
8888

89-
2. Select **Incident actions** from the command bar:
89+
1. Select **Incident actions** from the command bar:
9090

9191
:::image type="content" source="media/bookmarks/incident-actions.png" alt-text="Screenshot of adding bookmarks to incident.":::
9292

93-
3. Select either **Create new incident** or **Add to existing incident**, as appropriate. Then:
93+
1. Select either **Create new incident** or **Add to existing incident**, as appropriate. Then:
9494

9595
- For a new incident: Optionally update the details for the incident, and then select **Create**.
9696
- For adding a bookmark to an existing incident: Select one incident, and then select **Add**.
9797

98+
1. To view the bookmark within the incident,
99+
1. Go to **Microsoft Sentinel** > **Threat management** > **Incidents**.
100+
1. Select the incident with your bookmark and **View full details**.
101+
1. On the incident page, in the left pane, select the **Bookmarks**.
102+
103+
98104
## View bookmarked data in logs
99105

100106
View bookmarked queries, results, or their history.

0 commit comments

Comments
 (0)