Microsoft Sentinel Workbooks 101 (with sample Workbook)

Hi All, Matt_Lowe 

I am wondering if anybody can help out?

Goal/Objective:

• I want the USER of a Microsoft Workbook to be able to easily SELECT which columns in a workbook table they want to display
• Ideally this will be achieved by the user SELECTING options from a drop down list (as opposed to modifying any underlying KQL).

Proposed Method:

• In order to try and implement this- I have defined a workbook global parameter called [columns_to_project]. 
• This parameter contains a drop-down list of ALL of the available columns in my final table.
• I am then hoping to only PROJECT the columns SELECTED by the user in this parameter

Screenshot 1: The new parameter I have created- in order to allow the user to SELECT which columns they want to display.

I have then created the following test table:

Screenshot 2: What the table should look like if all columns are displayed

Issues Encountered

Error 1: Attempted SYNTAX: | project {PARAMETER NAME}

Note: The Column names are included as strings in the final data- as opposed to the actual data itself

Error 2: Attempted SYNTAX: | project {PARAMATERNAME:label}
Result: The query fails

Error 3: Attempted SYNTAX: let variable_name=dynamic({PARAMATER NAME}); .. | Project variable_name

Result: Query fails

---------------------------------------------

Any advice on how to fix my existing solution? Or is there any alternative way to allow the user of a workbook to choose which columns to display in a table (...without them having to modify the KQL directly?)

Thanks in advance,

Ryan