You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/bookmarks.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ Threat hunting typically requires reviewing mountains of log data looking for ev
25
25
26
26
Hunting bookmarks in Azure Sentinel help you do this, by preserving the queries you ran in Log Analytics, along with the query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration.
27
27
28
-
You can revisit your bookmarked data at any time on the **Bookmark** tab of the **Hunting**blade. You can use filtering and search options to quickly find specific data for your current investigation. Alternatively, you can view your bookmarked data directly in the **HuntingBookmark** table in Azure Monitor. This enables you to filter, summarize, and join bookmarked data with other data sources, making it easy to look for corroborating evidence.
28
+
You can revisit your bookmarked data at any time on the **Bookmark** tab of the **Hunting**pane. You can use filtering and search options to quickly find specific data for your current investigation. Alternatively, you can view your bookmarked data directly in the **HuntingBookmark** table in Azure Monitor. This enables you to filter, summarize, and join bookmarked data with other data sources, making it easy to look for corroborating evidence.
29
29
30
30
Currently in preview, if you find something that urgently needs to be addressed while hunting in your logs, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see [Tutorial: Investigate incidents with Azure Sentinel](tutorial-investigate-cases.md).
31
31
@@ -42,16 +42,16 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
42
42
> [!div class="mx-imgBorder"]
43
43
> 
44
44
45
-
This action opens the query results in the **Logs**blade.
45
+
This action opens the query results in the **Logs**pane.
46
46
47
47
4. From the log query results list, expand the row that contains the information you find interesting.
48
48
49
-
5. Select the ellipsis (...) at the end of the row, and then select **Add hunting bookmark**:
49
+
5. Select the ellipsis (...) on the left, and then select **Add hunting bookmark**:
50
50
51
51
> [!div class="mx-imgBorder"]
52
52
> 
53
53
54
-
6. On the right, in the **Add hunting bookmark**blade, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.
54
+
6. On the right, in the **Add hunting bookmark**pane, optionally, update the bookmark name, add tags, and notes to help you identify what was interesting about the item.
55
55
56
56
7. In the **Query Information** section, use the drop down boxes to extract information from the query results for the **Account**, **Host**, and **IP address** entity types. This action maps the selected entity type to a specific column from the query result. For example:
57
57
@@ -64,7 +64,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
64
64
65
65
66
66
> [!NOTE]
67
-
> The log query results support bookmarks whenever this blade is opened from Azure Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs**blade is opened from other locations, such as directly from Azure Monitor.
67
+
> The log query results support bookmarks whenever this pane is opened from Azure Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident (currently in preview). You can't create bookmarks when the **Logs**pane is opened from other locations, such as directly from Azure Monitor.
68
68
69
69
## View and update bookmarks
70
70
@@ -74,7 +74,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
74
74
75
75
3. To help you find a specific bookmark, use the search box or filter options.
76
76
77
-
4. Select individual bookmarks and view the bookmark details in the right-hand details blade.
77
+
4. Select individual bookmarks and view the bookmark details in the right-hand details pane.
78
78
79
79
5. Make your changes as needed, which are automatically saved.
80
80
@@ -102,7 +102,7 @@ For instructions to use the investigation graph, see [Use the investigation grap
102
102
103
103
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to add to an incident.
104
104
105
-
2. Select **Incident actions (Preview)**:
105
+
2. Select **Incident actions (Preview)** from the command bar:
106
106
107
107
> [!div class="mx-imgBorder"]
108
108
> 
@@ -116,21 +116,21 @@ To view the bookmark within the incident: Navigate to **Sentinel** > **Threat ma
116
116
117
117
## View bookmarked data in logs
118
118
119
-
To view bookmarked queries, results, or their history, select the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details blade:
119
+
To view bookmarked queries, results, or their history, select the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details pane:
120
120
121
-
-**View source query** to view the source query in the **Logs**blade.
121
+
-**View source query** to view the source query in the **Logs**pane.
122
122
123
123
-**View bookmark logs** to see all bookmark metadata, which includes who made the update, the updated values, and the time the update occurred.
124
124
125
-
You can also view the raw bookmark data for all bookmarks by selecting **Bookmark Logs** from the **Hunting**blade:
125
+
You can also view the raw bookmark data for all bookmarks by selecting **Bookmark Logs** from the command bar on the **Hunting**> **Bookmarks** tab:
This view shows all your bookmarks with associated metadata. You can use [Keyword Query Language](https://docs.microsoft.com/sharepoint/dev/general-development/keyword-query-language-kql-syntax-reference) (KQL) queries to filter down to the latest version of the specific bookmark you are looking for.
131
131
132
132
> [!NOTE]
133
-
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks** tab. Because of this delay, we recommend you create your bookmarks first, then analyze them after the data is ingested.
133
+
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks** tab.
0 commit comments