Forum Discussion
Workbook Logos and Descriptions
We are wanting to push branding, descriptions and possibly screenshot examples with our custom workbooks but are at a loss at where/how this would be accomplished. Is this feature supported? I have...
Perfect! Thank you very much for this. Other than a pr, how would this get pushed into Azure Sentinel? Could this be pushed via API into the workspace?
CliveWatson
Microsoft
MicrosoftCliveWatson My apologies, I do believe it was too vague in my initial request. I am looking to push a logo/description with the workbook to be displayed within "My Workbooks" The logo would be presented in the area marked with the default logo and description would replace "Customer Defined Workbook" I am familiar with pushing workbooks via the deployment methods suggested but am unsuccessful when it comes to finding the parameter within the template that defines the logo or the presented description.
- CliveWatsonLogos are outside your template, they are referenced in https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json and stored in https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks/Images/Logos
Please see https://github.com/Azure/Azure-Sentinel/tree/master/Workbooks#step-2---create-a-pull-request-to-this-repository
Take a look in WorkbooksMetadata.json for examples like:
{
"workbookKey": "AIVectraDetectWorkbook",
"logoFileName": "AIVectraDetect.svg",
"description": "Start investigating network attacks surfaced by Vectra Detect directly from Sentinel. View critical hosts, accounts, campaigns and detections. Also monitor Vectra system health and audit logs.",
"dataTypesDependencies": ["CommonSecurityLog"],
"dataConnectorsDependencies": ["AIVectraDetect"],
"previewImagesFileNames": ["AIVectraDetectWhite1.png", "AIVectraDetectBlack1.png"],
"version": "1.1",
"title": "AI Vectra Detect",
"templateRelativePath": "AIVectraDetectWorkbook.json",
"subtitle": "",
"provider": "Vectra AI"
},- Understood, is there a mechanism to push the workbook with the associated metadata (logo, description ..) other than creating a PR? I would like to push these workbooks out individually and not via PR if possible.
