Using Azure Sentinel Notebooks
Sometimes, just using KQL queries against logs does not give enough information to assist with properly performing hunting activities. In cases such as this, you can use Jupyter Notebooks, hosted in the Azure Notebooks service, to perform additional work. Jupyter Notebooks combine text with code and outputs to provide an overall view of your threat- hunting activities. The code can be written in Python, F#, and other languages, so threat hunters can work with a language they are most likely already familiar with.
Note
The full scope of Jupyter Notebooks is beyond the scope of this book. For more information, go to https://jupyter.org/.
Click on Notebooks in the Azure Sentinel navigation area to go to the Notebooks page, which will look as in the following screenshot:
Figure 10.19 – Notebooks page overview
Each of the sections on this page is described in more detail in the following sections.
