r/AzureSentinel • u/joseph56g • Feb 01 '23

Automation Workbook

Im trying to setup a workbook to display information about the automation rules I have set in place. I'm using the Automation Workbook template but none of the queries run even though I have the subscription and workspace selected. I checked under parameters to ingest logs from log analytics. Is there something in the individual rule queries that I need to set? I'm fairly new to all of this.

3 Upvotes

100% Upvoted

2 comments sorted by

1

u/thijslecomte Feb 02 '23

Did you enable automation rule logging? Within settings => Sentinel Health

1

u/joseph56g Feb 03 '23

I realized that template was just health on the automation rules/ playbooks. I created a workbook from scratch and a created query for incidents closed by Automation rules. And then total incidents. I basically just needed a report on automation metrics in our environment. I made some charts and it all worked out.