Skip to content

Commit ffc1667

Browse files
author
cabailey
committed
add picture to help find Bookmark Logs
1 parent ad8c5f9 commit ffc1667

File tree

2 files changed

+8
-3
lines changed

2 files changed

+8
-3
lines changed

articles/sentinel/bookmarks.md

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,19 @@ To view the bookmark within the incident: Navigate to **Sentinel** > **Threat ma
114114

115115
## View bookmarked data in logs
116116

117-
There are multiple options to viewing your bookmarked data in logs.
118-
119-
The easiest way to view bookmarked queries, results, or history is by selecting the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details pane. Options include:
117+
To view bookmarked queries, results, or their history, select the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details pane. Options include:
120118

121119
- **View source query** to view the source query in the **Logs** blade.
122120

123121
- **View bookmark logs** to see all bookmark metadata, which includes who made the update, the updated values, and the time the update occurred.
124122

123+
You can also view the raw bookmark data for all bookmarks by selecting **Bookmark Logs** from the **Hunting** blade:
124+
125+
> [!div class="mx-imgBorder"]
126+
> ![Bookmark Logs](./media/bookmarks/bookmark-logs.png)
127+
128+
This view shows all your bookmarks with associated metadata. You can use KQL queries to filter down to the latest version of the specific bookmark you are looking for.
129+
125130
> [!NOTE]
126131
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks** tab. Because of this delay, we recommend you create your bookmarks first, then analyze them after the data is ingested.
127132
4.5 KB
Loading

0 commit comments

Comments
 (0)