Forum Discussion
Investigation Insights Workbook IP address Search
Is there a way to roll back to a previous version of the investigation insights workbook? The new workbook from the content hub no longer allows you to enter an IP address without selecting entities ...
I figured out that this doesn't appear to be working (for me at least) when opening the workbook from the Sentinel integration to Microsoft 365 Defender/Defender XDR portal (security.microsoft.com). When I attempt to enter the data from this portal then the entry is ignored. I can enter the IP address and then click apply but the value remains as the unset.
If I use the standalone Sentinel portal then this appears to be working fine for me when I just want to use the Investigate IP Address or Investigate Account options, and manually enter a value not associated to an incident or alert entity.