Forum Discussion
Investigation Insights Workbook IP address Search
I figured out that this doesn't appear to be working (for me at least) when opening the workbook from the Sentinel integration to Microsoft 365 Defender/Defender XDR portal (security.microsoft.com). When I attempt to enter the data from this portal then the entry is ignored. I can enter the IP address and then click apply but the value remains as the unset.
If I use the standalone Sentinel portal then this appears to be working fine for me when I just want to use the Investigate IP Address or Investigate Account options, and manually enter a value not associated to an incident or alert entity.
- Clive_WatsonJan 28, 2025Bronze Contributor
That portal integration never existed when we created the workbook so wasn't tested, however it should "just work" but let me take a look if I get some time