Blog Post

Microsoft Sentinel Blog
4 MIN READ

What's New: SOC Process Framework is Now Live in Content Hub!

RinUre's avatar
RinUre
Icon for Microsoft rankMicrosoft
Aug 18, 2022
I am excited to announce that the SOC Process Framework has been updated and moved into Sentinel's Content Hub for installation across multiple workbooks, watchlists, and the amazing Get-SOCActions P...
Updated Aug 18, 2022
Version 1.0
deployment and configuration
siem
soar
solutions
RinUre's avatar
Icon for Microsoft rankMicrosoft
Joined January 09, 2020
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

acheca's avatar
acheca
Copper Contributor
Aug 23, 2022

ThomasVrhydn Dean_Gross You just need to populate first the pills at the workbook (before editing the query) in order for it to work and have the parameters to be used filled:

 

Query: {Subscription}/resourceGroups/{InternalRG}/providers/Microsoft.OperationalInsights/workspaces/{InternalWSs}/providers/Microsoft.SecurityInsights/watchlists?api-version=2019-01-01-preview

 

Regards.

 

PS: {InternalWSs}: I need to write this pill by hand for the query to work.

PS2: For the other two workbooks, just add to the query at the end "-preview" (2022-05-01-preview) to have the right API.