SOLVED

Creating bookmarks broken?

%3CLINGO-SUB%20id%3D%22lingo-sub-976435%22%20slang%3D%22en-US%22%3ECreating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-976435%22%20slang%3D%22en-US%22%3E%3CP%3EI%20was%20following%20this%20page%20to%20create%20a%20new%20bookmark%20but%20when%26nbsp%3B%20I%20get%20to%20the%20section%20that%20states%20to%20click%20on%20the%20checkbox%20to%20the%20left%20of%20the%20result%20row%20in%20Logs%20there%20is%20no%20checkbox%20there.%26nbsp%3B%20I%20also%20do%20not%20see%20the%20%3CSTRONG%3EAdd%20Bookmark%3C%2FSTRONG%3E%20button%20but%20it%20may%20be%20I%20need%20to%20select%20a%20row%20first%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fbookmarks%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fbookmarks%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-977437%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-977437%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F46875%22%20target%3D%22_blank%22%3E%40Gary%20Bushey%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20do%20need%20a%20Hunting%20Query%20to%20have%20results%20(rows%20returned)%3B%20you%20can%20then%20click%20on%20the%20check%20box%20to%20access%20the%20%3CSTRONG%3EAdd%20Bookmark%3C%2FSTRONG%3E%20button.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F154525i52994DDD1C21C5E3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_0.png%22%20title%3D%22clipboard_image_0.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-977636%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-977636%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%26nbsp%3BThat%20is%20exactly%20what%20I%20did%20but%20I%20still%20do%20not%20see%20any%20checkboxes.%26nbsp%3B%20I've%20tried%20this%20in%20a%20couple%20of%20different%20tenants%20with%20different%20browsers%20and%20the%20checkboxes%20never%20show%20up%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20style%3D%22width%3A%20658px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F154548iE366C8B48E65B1BF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22NoCheckbox.png%22%20title%3D%22NoCheckbox.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-991636%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-991636%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20image%20better%20shows%20that%20I%20am%20coming%20from%20Threat%20Hunting%20(look%20at%20the%20breadcrumbs).%26nbsp%3B%20I%20am%20running%20the%20%22SharePointFileOperation%20vai%20previously%20unseen%20IPs%22%20query%20but%20there%20are%20no%20checkboxes%20available.%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F155607iA00402039539BBC4%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22Nocheckboxes.png%22%20title%3D%22Nocheckboxes.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%E2%80%83%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-994119%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-994119%22%20slang%3D%22en-US%22%3E%3CP%3EI%20did%20find%20that%20if%20I%20expand%20a%20row%20there%20is%20a%20%3CSTRONG%3EAdd%20Hunting%20bookmark%26nbsp%3B%3C%2FSTRONG%3Ebutton%20that%20will%20open%20a%20new%20blade%20that%20gives%20you%20a%20lot%20of%20options.%26nbsp%3B%20Is%20this%20a%20new%20UI%20design%3F%26nbsp%3B%20I%20would%20be%20great%20to%20add%20multiple%20rows%20at%20one%20time%20rather%20than%20just%20one%20at%20a%20time.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F155756i496CC60C26A1CCE9%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22Nocheckboxes.png%22%20title%3D%22Nocheckboxes.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%E2%80%83%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-998595%22%20slang%3D%22en-US%22%3ERe%3A%20Creating%20bookmarks%20broken%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-998595%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F239477%22%20target%3D%22_blank%22%3E%40Clive%20Watson%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%20Any%20updates%20on%20what%20may%20be%20causing%20this%3F%26nbsp%3B%20Was%20going%20to%20double%20check%20this%20again%20but%20Azure%20is%20saying%20my%20Sentinel%20workspace%20no%20longer%20exists.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Super Contributor

I was following this page to create a new bookmark but when  I get to the section that states to click on the checkbox to the left of the result row in Logs there is no checkbox there.  I also do not see the Add Bookmark button but it may be I need to select a row first

 

https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

6 Replies
Highlighted

@Gary Bushey 

 

You do need a Hunting Query to have results (rows returned); you can then click on the check box to access the Add Bookmark button.

 

clipboard_image_0.png

Highlighted

@Clive Watson That is exactly what I did but I still do not see any checkboxes.  I've tried this in a couple of different tenants with different browsers and the checkboxes never show upNoCheckbox.png

 

Highlighted

This image better shows that I am coming from Threat Hunting (look at the breadcrumbs).  I am running the "SharePointFileOperation vai previously unseen IPs" query but there are no checkboxes available. 

Nocheckboxes.png

 

Highlighted

I did find that if I expand a row there is a Add Hunting bookmark button that will open a new blade that gives you a lot of options.  Is this a new UI design?  I would be great to add multiple rows at one time rather than just one at a time.

Nocheckboxes.png

Highlighted

@Clive Watson  Any updates on what may be causing this?  Was going to double check this again but Azure is saying my Sentinel workspace no longer exists.

Highlighted
Solution

This seems to have been resolved as of this morning.  When I went into a Threat query results I noticed the checkboxes were showing up again. :)