Edit workbooks directly in the Microsoft Defender portal (Preview)

August 2025
Edit workbooks directly in the Microsoft Defender portal

Edit workbooks directly in the Microsoft Defender portal (Preview)
Now you can create and edit Microsoft Sentinel workbooks directly in the Microsoft Defender portal. This enhancement streamlines your workflow, allows you to manage your workbooks more efficiently, and brings the workbook experience more closely aligned with the experience in the Azure portal.

Microsoft Sentinel workbooks are based on Azure Monitor workbooks, and help you visualize and monitor the data ingested to Microsoft Sentinel. Workbooks add tables and charts with analytics for your logs and queries to the tools already available.

Workbooks are available in the Defender portal under Microsoft Sentinel > Threat management > Workbooks. For more information, see Visualize and monitor your data by using workbooks in Microsoft Sentinel.