Forum Discussion
How to Filter Logs by User Parameter in Sentinel Workbook KQL?
Hi everyone, I am trying to create a Sentinel Workbook with a dropdown parameter to filter logs based on a selected username. The goal is to dynamically toggle between users and see logs related t...
One thing I would recommend is to create a new Text step that displays just {{UserParam}} to make sure it is actually returning what you expect. It may have a subfield is extra text that you are not expecting. There may also be a case mismatch so you may need "=~" rather than "==" when comparing that field