dashboards
43 TopicsPlotly visualizations in Azure Data Explorer
We extend the set of ADX visualizations, supporting advanced interactive visualizations by Plotly graphics library. Plotly supports ~80 chart types including basic charts, scientific, statistical, financial, maps, 3D, animations and more.10KViews6likes0CommentsAzure Sentinel how to clear Threat Intelligence Indicator table
Is there a way to do a bulk delete of all indicators? I have the DShieldScanningIPs source with over 100 thousand IP and I'd like to delete them all but it appears I can only delete 100 of them at a time. This will take a while.5.5KViews0likes4CommentsAzure Sentinel Workbook & Azure Dashboard Sharing to external B2B guest users
Hi, I am trying to share Azure Sentinel Workbooks (custom) & as well as Azure Dashboards to external guest users i.e. Azure B2B user accounts but not able to share it. I get error even after of assigning appropriate RBAC roles (mostly tried Azure Log analytics Reader, Azure Sentinel Reader & Reader) at different levels. Please note: This sharing is for external B2B users. Appreciate your response. Thanks.Solved4.5KViews0likes6CommentsKQL to count current enabled, disabled analytic rules
Hi, Would like some help in an KQL query to count the number of enabled and disabled analytic rules for entry into a workbook. Plus a simple count of connected data connectors so the number reflects the overview number and not all the enabled data types. Many thanks, Tim3.4KViews0likes1CommentSentinel Creating Multiple AlertIDs/IncidentNumbers for Multiple Events
Hey there, This one is really giving me hard times as I can't quite understand why or how to fix this. In Sentinel, we run a log search in the LAW, and we get a full list of SecurityIncidents using the below. SecurityIncident | where TimeGenerated > ago(30d) This is fine. It gives us a fill list of all SecurityIncidents in the last 30 days. However, it brings up a total of 1000 incidents, when we've only seen 325. The remaining 675 are all duplicated in some way. Either duplicate AlertID or Incident Numbers. This really messes with my reports, as I us these to get understanding on how many incidents we see. But it's nearly impossible when the values are skewed before I even get them out of Sentinel. With that being said, I've tried to use the following KQL to get more defined metrics, but this still doesn't work. SecurityIncident | where TimeGenerated > ago(30d) | summarize any(IncidentName) by Title, Description, ClosedTime,Status,TimeGenerated,IncidentNumber The Distinct operator also doesn't seemingly work, unless I'm using it in the wrong way. Any help would be greatly appreciated, as I am really struggling with this one! Kind Regards., C.Solved2.5KViews0likes3Comments