drill down in azure sentinel workbook

Question

In Splunk, we have the drill-down option in the dashboard so is that possible in azure sentinel workbook? consider I have one chart(tile or piechart) so when I click on that I want to open another tab. Is it possible in azure sentinel workbook?

Answer 1

You can use a custom drill down on almost all Splunk visualisations. Refer to https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DrilldownIntro and https://docs.splunk.com/Documentation/Splunk/8.0.2/Viz/DrilldownLinkToURL

You can edit your dashboards to include a snippet such as the following, which will pass the value that was clicked as an argument to the target URL.

<drilldown>
    <link>
        [target_URL]?q=[$click.value$]
    </link>
</drilldown>

However, Azure Sentinel Workbook will require that you are able to pass parameters as part of the URL.

Answer 2

currently workbooks does not have a way to open up other views purely from selection in charts/grids/etc.

workbooks does allow exporting those selections as parameters within the workbook to allow further drill-in inside the workbook by using those parameters, and i believe there are several sentinel workbooks that do that. A link step in the workbook could use those parameters to create links that would open up other tabs, but the portal itself has limitations on extensions that prevent them to directly open other tabs on selections.

see: workbooks interactivity docs, which has explanations on how to hook that up.