For those that do more in the Azure portal everyday than just Azure Sentinel analyst work, it may be helpful to pin some of the more valuable data representations in Sentinel Workbooks to the general Azure portal dashboard. Azure dashboards give immediate access to a host of valuable data, and by “pinning” Azure Sentinel Workbooks, can bolster that value.
How to do it
After you have enabled an Azure Sentinel Workbook by saving the template, you can then choose to View the Saved Workbook.
Once inside the Workbook page, right next to the Workbook title, you have an option to very quickly use the pin icon to generate a new Azure dashboard. Don’t do this – or, rather – don’t do it this way. Doing it this way simply inserts a “shortcut” to the Workbook on the Azure portal dashboard instead of pinning the entire Workbook and all its stunning visuals – which is what we’re actually after.
Instead, click the Edit button for the Workbook, then choose the new pin icon exposed in the editor. And, then select the Pin All option (Pin all of the pinnable steps in this workbook to the dashboard). Once you do this, you’ll be presented with the naming and saving dialog. Complete this appropriately.
After this step completes, you can now jump out to the general Azure portal Dashboard area, click the dropdown for available dashboards at the top left, and select your newly pinned, full Azure Sentinel dashboard.
You may also want to modify the auto-refresh value for the dashboard to ensure that new dashboard updates its data in a timelier manner.
Alternatively, using this same method you can combine Azure Sentinel Workbooks into single Azure Dashboards, or even select multiple visual components from various Workbooks to create a very customized Azure Sentinel data view in a single Azure Dashboard.
P.S. After you’ve mastered the art of the pin, check out how to Share Workbooks Outside Azure Sentinel with Non-analysts. That’s the logical next step for this ability and answers a common customer question. Pinning a Workbook to a Dashboard still only provides access to those who have proper credential assignments to Azure Sentinel resources. What if you want to share a Workbook/Dashboard with a manager or any other non-analyst user? That’s where Share Workbooks Outside Azure Sentinel with Non-analysts comes into play.
Reference: https://azurecloudai.blog/2020/07/06/pinning-entire-azure-sentinel-workbooks-to-azure-dashboards/
