You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/bookmarks.md
+15-14Lines changed: 15 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,22 +29,22 @@ You can revisit your bookmarked data at any time on the **Bookmark** tab of the
29
29
30
30
Currently in preview, if you find something that urgently needs to be addressed while hunting in Log Analytics, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see [Tutorial: Investigate incidents with Azure Sentinel](tutorial-investigate-cases.md).
31
31
32
-
Also in preview, you can visualize your bookmarked data, by clicking **Investigate** from bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
32
+
Also in preview, you can visualize your bookmarked data, by clicking **Investigate** from the bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
33
33
34
34
## Add a bookmark
35
35
36
36
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** to run queries for suspicious and anomalous behavior.
37
37
38
38
2. Select one of the hunting queries and on the right, in the hunting query details, select **Run Query**.
39
39
40
-
3. Select **View query results** to view the query results in the **Logs** blade. For example:
40
+
3. Select **View query results** to view the query results. For example:
41
41
42
42
> [!div class="mx-imgBorder"]
43
43
> 
44
44
45
-
4. In the log query results list, expand the row containing the information that you find interesting.
45
+
4. In the **Logs** blade, log query results list, expand the row that contains the information you find interesting.
46
46
47
-
5. Select the ellipsis (...) at the end of the row, and select **Add hunting bookmark**:
47
+
5. Select the ellipsis (...) at the end of the row, and then select **Add hunting bookmark**:
48
48
49
49
> [!div class="mx-imgBorder"]
50
50
> 
@@ -74,8 +74,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
74
74
75
75
4. Select individual bookmarks and view the bookmark details in the right-hand details pane.
76
76
77
-
5. To update tags and notes, make your changes in the editable text boxes, and then click **Save**.
78
-
77
+
5. Make your changes in the editable text boxes.
79
78
80
79
## Exploring bookmarks in the investigation graph
81
80
@@ -86,7 +85,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
86
85
87
86
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to investigate.
88
87
89
-
2. In the bookmark details pane, ensure that at least one entity is mapped. For example, for **ENTITIES**, you see entries for **IP**, **Machine**, or **Account**.
88
+
2. In the bookmark details, ensure that at least one entity is mapped. For example, for **ENTITIES**, you see entries for **IP**, **Machine**, or **Account**.
90
89
91
90
3. Click **Investigate** to view the bookmark in the investigation graph.
92
91
@@ -113,19 +112,21 @@ For instructions to use the investigation graph, see [Use the investigation grap
113
112
114
113
To view the bookmark within the incident: Navigate to **Sentinel** > **Threat management** > **Incidents** and select the incident with your bookmark. Select **View full details**, and then select the **Bookmarks** tab.
115
114
116
-
## View bookmarked data in Log Analytics
115
+
## View bookmarked data in logs
116
+
117
+
There are multiple options to viewing your bookmarked data in logs.
118
+
119
+
The easiest way to view bookmarked queries, results, or history is by selecting the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details pane. Options include:
117
120
118
-
There are multiple options to viewing your bookmarked data in Log Analytics.
121
+
-**View source query** to view the source query in the **Logs** blade.
119
122
120
-
The easiest way to view bookmarked queries, results, or history is by selecting the desired bookmark in the **Bookmarks** table and use the links provided in the details pane. Options include:
121
-
- Click **View query** to view the source query in Log Analytics.
122
-
- Click **View bookmark history** to see all bookmark metadata including: who made the update, the updated values, and the time the update occurred.
123
+
-**View bookmark logs** to see all bookmark metadata, which includes who made the update, the updated values, and the time the update occurred.
123
124
124
-
-You can also view the raw bookmark data for all bookmarks by clicking on **Bookmark logs** above the bookmark grid. This view will show the all your bookmarks in the hunting bookmark table with associated metadata. You can use KQL queries to filter down to the latest version of the specific bookmark you are looking for.
125
+
You can also view the raw bookmark data for all bookmarks by clicking on **Bookmark logs** above the bookmark grid. This view will show the all your bookmarks in the hunting bookmark table with associated metadata. You can use KQL queries to filter down to the latest version of the specific bookmark you are looking for.
125
126
126
127
127
128
> [!NOTE]
128
-
> There can be significant delay (measured in minutes) between the creation of a bookmark and when it is displayed in the **HuntingBookmark**table. It is recommended to create your bookmarks first, then analyze them after the data is ingested.
129
+
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks**tab. Because of this delay, we recommend you create your bookmarks first, then analyze them after the data is ingested.
0 commit comments