Using Microsoft Sentinel notebooks

Sometimes, just using KQL queries against logs does not give enough information to assist with properly performing hunting activities. In cases such as this, you can use the Jupyter notebook, hosted in the Microsoft Azure Machine Learning (AML) service, to perform additional work. The Jupyter Notebook combines text with code to provide an overall view of your threat-hunting activities. The code can be written in Python, PowerShell, and other languages, so threat hunters can work with a language they are most likely already familiar with.

Important Note

The full scope of the Jupyter Notebook is beyond the scope of this book. For more information, go to https://jupyter.org/.

Click on Notebooks in the Microsoft Sentinel navigation area to go to the Notebooks page, which will look like the following screenshot:

Figure 11.20 – Notebooks page overview

Each of the areas on this page is described in more detail in...