Azure Sentinel Workbook, using tabs to create parameters

[tipper1510]

Have created a few tabs, with the action of set a parameter value. Have given a name and value.

I can't seem to then use that parameter in my kql query.

I have attempted to use the following syntax:

where SourceSystem contains ({parameter name})

and get an error 'where' operator. failed to resolve scalar expression named 'parameter value'

Any help would be much appreciated...

Regards,

Tim

[#2]

@tipper1510 What are you trying to do with the parameter from the tab?  Typically that is only used to determine what groups/steps to show/hide.

If you go under the Advanced Settings for each group/step you will see there is a "Make this item conditionally visible" checkbox.  Check that and then use the parameter from your tab to make certain parts of your workbook visible when the tab is selected.

[#3]

@Gary Bushey 

Hi Gary,

Thanks for your reply.

I was trying to use the parameter value in the kql query of a specific graph, so when a tab was selected it would only show the data related to the criteria of the tab, set by the parameter value. In my case trying to show different sources of threat intelligence...

Regards,

Tim

[#4]

@tipper1510 Got it.   The easiest way would be to create a different step for each tab that uses a different parameter in the code.   I cannot find any other way to do this.