Give users access to run one specific workbook but not all of Sentinel

[Lassekatten]

Hi guys,

I need to create a solution that allows a few consultants to query login events on servers without giving them access to all of our SIEM data. 

I have created a workbook with the parameter: serverName and the simple query:

DeviceLogonEvents

| where DeviceName contains "{serverName}" 

I would like for the consultants to be able to input the parameter value and then receive the results without getting access to editing the query or all of the data in Sentinel. 

I am wondering how I can achieve this in the easiest way possible?

I hope someone can be of help! :)

Br.

Lars

[#2]

@Lassekatten One thing I can think of is to use a Watchlist that maps the users to what server(s) they can select.  You can then write a query for the server parameter that would show which server(s) they could select.

It appears that if the users do NOT have the Monitor Contributor role they will not be able to edit a workbook, only use it.