Forum Discussion
Investigation Insights Workbook IP address Search
I figured out that this doesn't appear to be working (for me at least) when opening the workbook from the Sentinel integration to Microsoft 365 Defender/Defender XDR portal (security.microsoft.com). When I attempt to enter the data from this portal then the entry is ignored. I can enter the IP address and then click apply but the value remains as the unset.
If I use the standalone Sentinel portal then this appears to be working fine for me when I just want to use the Investigate IP Address or Investigate Account options, and manually enter a value not associated to an incident or alert entity.
That portal integration never existed when we created the workbook so wasn't tested, however it should "just work" but let me take a look if I get some time