Merge pull request #50598 from KenMAG/main

Updated module with revised steps to use Azure ML.

Author: Stacyrch140

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/1-introduction.yml

@@ -4,8 +4,8 @@ title: Introduction
 metadata:
   title: Introduction
   description: "Introduction"
-  ms.date: 10/12/2022
-  author: wwlpublish
+  ms.date: 5/22/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 azureSandbox: false

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/4-create-notebook.yml

@@ -4,8 +4,8 @@ title: Create a notebook
 metadata:
   title: Create a notebook
   description: "Create a notebook"
-  ms.date: 10/12/2022
-  author: wwlpublish
+  ms.date: 5/22/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 azureSandbox: false

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/5-explore-notebook-code.yml

@@ -4,8 +4,8 @@ title: Explore notebook code
 metadata:
   title: Explore notebook code
   description: "Explore notebook code"
-  ms.date: 10/12/2022
-  author: wwlpublish
+  ms.date: 5/22/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 azureSandbox: false

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/includes/1-introduction.md

@@ -1,6 +1,6 @@
 You can use notebooks in Microsoft Sentinel for advanced hunting. 
 
-You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel.  You want to mature your Security Operations team to proactively hunt for malicious activity in your environment with advanced machine learning capabilities.  
+You're a Security Operations Analyst working at a company that implemented Microsoft Sentinel. You want to mature your Security Operations team to proactively hunt for malicious activity in your environment with advanced machine learning capabilities.  
 
 After developing your hunting hypothesis, you utilize a Jupyter notebook to integrate machine learning libraries, advanced visualizations, and external data to detect malicious activity patterns.
 
@@ -12,4 +12,6 @@ After completing this module, you'll be able to:
 
 ## Prerequisites
 
-Basic knowledge of operational concepts such as monitoring, logging, and alerting
+- Basic knowledge of operational concepts such as monitoring, logging, and alerting
+- Familiarity deploying Azure services
+- Familiarity with scripting and Python coding

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/includes/4-create-notebook.md

@@ -1,8 +1,8 @@
-To start with Notebooks, use the "Getting Started Guide For Microsoft Sentinel ML Notebooks" notebook.
+To get started with Notebooks, use the *Getting Started Guide For Microsoft Sentinel ML Notebooks* notebook.
 
-1. In the Microsoft Sentinel Workspace, select **Notebooks** 
+1. In the Microsoft Sentinel navigation menu, expand the *Threat Management* section, and select **Notebooks**
 
-1. You need to create an AzureML Workspace. Select **Configure Azure Machine Learning** then **Create new Azure ML workspace**.
+1. You need to create an Azure Machine Learning (ML) Workspace. From the menu, select **Configure Azure Machine Learning**, then **Create new Azure ML workspace**.
 
 1. In the Subscription box, select your subscription.
 
@@ -14,33 +14,76 @@ To start with Notebooks, use the "Getting Started Guide For Microsoft Sentinel M
 
     - Choose your Region
 
-    - Save your Storage account, Key vault, and Application insights information.
+    - Keep the default Storage account, Key vault, and Application insights information.
 
     - The Container registry option can remain as None.
 
-1. At the bottom of the page, select **Review + create**. Then on the next page, select **create**. It will take a moment to deploy the workspace.
+1. At the bottom of the page, select **Review + create**. Then on the next page, select **create**. It takes a moment to deploy the workspace.
 
-1. Navigate to the Microsoft Sentinel workspace, select **Notebooks**. 
+    > [!NOTE]
+    > It takes a few minutes to deploy the Machine Learning workspace.
 
-1. Select the **Templates** tab. 
+1. After *Your deployment is complete* message appears, return to Microsoft Sentinel.
 
-1. Select the **A Getting Started Guide For Microsoft Sentinel ML Notebooks** from the list. 
+1. Navigate to the Threat Management section, and select **Notebooks**.
 
-1. Select **Create from template** on the bottom of the right page. 
+1. Select the **Templates** tab.
 
-1. Select the **Save**.
+1. Select the **A Getting Started Guide For Microsoft Sentinel ML Notebooks** from the list.
 
-1. Select the **Launch notebook**.
+1. Select **Create from template** button on the bottom of the detail pane.
 
-1. Next to the Compute instance selector at the top of the screen, select the **+**.
+1. Review the default options and then select **Save**.
 
-1. Choose your compute settings.
+1. Select the **Launch notebook** button.
 
-1. Name your Compute instance and select the **Create** button at the bottom of the screen.
+1. Select **Close** if an informational window appears in the Microsoft Azure Machine Learning studio.
 
-1. Wait for the compute instance to finish creating.
+1. 1. In the command bar, to the right of the **Compute:**  selector, select the **+** symbol to *Create Azure ML compute* instance. **Hint:** It might be hidden inside the ellipsis icon **(...)**.
 
-1. In the top right of the notebook, select a Kernel to use if not selected.
+    > [!NOTE]
+    > You can have more screen space by hiding the Azure ML Studio left menu selections. Select the *Hamburger menu* (3 horizontal lines on the top left), and by collapsing the Notebooks Files by selecting the **<<** icon.
 
-1. Follow the instructions in the Notebook.
+1. Type a unique name in the *Compute name* field. This identifies your compute instance.
 
+1. Scroll down and select the first option available.
+
+    > [!TIP]
+    > Workload type: Development on Notebooks (or other IDE) and lightweight testing.
+
+1. Select the **Review + Create** button at the bottom of the screen, then scroll down and select **Create**. Close any feedback window that appears. This takes a few minutes. You see a notification (bell icon) when it completes and the *Compute instance* left icon turns from blue to green.
+
+1. Once the Compute is created and running, verify that the kernel to use is *Python 3.10 - Pytorch and Tensorflow*.
+
+    > [!TIP]
+    > This is shown in the right of the menu bar. If that kernel isn't selected, select the *Python 3.10 - Pytorch and Tensorflow* option from the drop-down list. You can select the **Refresh** icon on the far right to see the kernel options.
+
+1. Select the **Authenticate** button and wait for the authentication to complete.
+
+1. Clear all the results from the notebook by selecting the **Clear all outputs** (Eraser icon) from the menu bar and follow the *Getting Started* tutorial.
+
+    > [!TIP]
+    > This can be found by selecting the ellipsis (...) from the menu bar.
+
+1. Review section *1 Introduction* in the notebook and proceed to section *2 Initializing the notebook and MSTICPy*.
+
+    > [!TIP]
+    > Section 1.2 *Running code in notebooks* lets you practice running small lines of Python code.
+
+1. In section *2 Initializing the notebook and MSTICPy*, review the content on Initializing the notebook and installing the MSTICPy package.
+
+1. Run the *Python code* to initialize the cell by selecting the **Run cell** button (Play icon) to the left of the code.
+
+1. It should take >30 seconds to run. Once it completes, review the output messages and *disregard any warnings about the Python kernel version* or other error messages.
+
+1. The code ran successfully if *msticpyconfig.yaml* was created in the *utils* folder in the *file explorer* pane on the left. It can take another 30 seconds for the file to appear. If it doesn't appear, select the **Refresh** icon in the *file explorer* pane.
+
+    > [!TIP]
+    > You can clear the output messages by selecting the ellipsis (...) on the left of the code window for the *Output menu* and selecting the *Clear output* (square with an x*) icon.
+
+1. Select the **msticpyconfig.yaml** file in the *file explorer* pane on the left to review the contents of the file and then close it.
+
+1. Proceed to section *3 Querying data with MSTICPy* and review the contents. Don't run the *Multiple Microsoft Sentinel workspaces* code cell as it fails, but the other code cells can be run successfully.
+
+> [!NOTE]
+> If you can't complete the steps above to access the Notebook, you can follow it on its GitHub viewer page instead. [Getting Started with Azure ML Notebooks and Microsoft Sentinel](https://nbviewer.org/github/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb)

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/includes/5-explore-notebook-code.md

@@ -1,16 +1,16 @@
-The following code blocks of the "Getting Started Guide For Microsoft Sentinel ML Notebooks" notebook provide a representative example of working with Microsoft Sentinel data.
+The following code blocks provide a representative example of using notebooks to work with Microsoft Sentinel data.
 
 **Code Block**
 
 In this snippet of code:
 
 - Create a new variable [test_query] that contains the KQL query.
 
-- Next, you run the query [qry_prov.exec_query()].  This utilizes the msticpy library to execute the KQL query in the Microsoft Sentinel Log Analytics related workspace.  The results are stored in the [test_df] variable.
+- Next, you run the query [qry_prov.exec_query()]. This utilizes the msticpy library to execute the KQL query in the Microsoft Sentinel Log Analytics related workspace. The results are stored in the [test_df] variable.
 
 - Next, display the first five rows with the xxx_xxxx.head() function.
 
-:::image type="content" source="../media/threat-hunt-1.png" alt-text="Screenshot of a Sentinel Notebook Sample 1 Query.":::
+:::image type="content" source="../media/threat-hunt-1.png" alt-text="Screenshot of a Microsoft Sentinel Notebook Sample 1 Query.":::
 
 **Code Block**
 
@@ -26,16 +26,16 @@ In this snippet of code:
 
 - The new function returns the Severity of the IP address.
 
-:::image type="content" source="../media/threat-hunt-3.png" alt-text="Screenshot of a Sentinel Notebook Sample 2 Query.":::
+:::image type="content" source="../media/threat-hunt-3.png" alt-text="Screenshot of a Microsoft Sentinel Notebook Sample 2 Query.":::
 
 **Code Block**
 
 In this snippet of code:
 
 - Create a new variable [vis_q] that contains the KQL query.
 
-- Next, you run the query [qry_prov.exec_query()].  This utilizes the msticpy library to execute the KQL query in the Microsoft Sentinel Log Analytics related workspace.  The results are stored in the [vis_data] variable.
+- Next, you run the query [qry_prov.exec_query()]. This utilizes the msticpy library to execute the KQL query in the Microsoft Sentinel Log Analytics related workspace. The results are stored in the [vis_data] variable.
 
-- Then, [qry_prov.exec_query()] returns  a pandas DataFrame that provides visualization features.  You then plot a bar graph with the unique IP addresses and how many times they were used in the first five entries of the Dataframe.
+- Then, [qry_prov.exec_query()] returns  a pandas DataFrame that provides visualization features. You then plot a bar graph with the unique IP addresses and how many times they were used in the first five entries of the Dataframe.
 
-:::image type="content" source="../media/threat-hunt-2.png" alt-text="Screenshot of a Sentinel Notebook Sample 3 Query.":::
+:::image type="content" source="../media/threat-hunt-2.png" alt-text="Screenshot of a Microsoft Sentinel Notebook Sample 3 Query.":::

learn-pr/wwl-sci/perform-threat-hunting-sentinel-with-notebooks/index.yml

@@ -3,21 +3,22 @@ uid: learn.wwl.perform-threat-hunting-sentinel-with-notebooks
 metadata:
   title: Hunt for threats using notebooks in Microsoft Sentinel
   description: "Hunt for threats using notebooks in Microsoft Sentinel"
-  ms.date: 10/12/2022
-  author: wwlpublish
+  ms.date: 5/22/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: module
   ms.service: microsoft-sentinel
 title: Hunt for threats using notebooks in Microsoft Sentinel
 summary: Learn how to use notebooks in Microsoft Sentinel for advanced hunting.
 abstract: |
-  Upon completion of this module, the learner will be able to:
+  Upon completion of this module, the learner is able to:
   - Explore API libraries for advanced threat hunting in Microsoft Sentinel
   - Describe notebooks in Microsoft Sentinel
   - Create and use notebooks in Microsoft Sentinel
 prerequisites: |
   - Basic knowledge of operational concepts such as monitoring, logging, and alerting
-  - Basic experience with Azure services
+  - Familiarity deploying Azure services
+  - Familiarity with scripting and Python coding
 iconUrl: /training/achievements/azure-sentinel-notebooks.svg
 levels:
 - intermediate