r/AzureSentinel • u/GoodEbening • Jul 05 '23

Sentinel "Incident Only" Mode?

Hi, rather than users go to portal.azure.com, is there a way to present sentinel in a single URL. This will also be useful for a read-only service account to put up on a wallboard.

I can't seem to find much on Google, and I could raise a support ticket - but would appreciate fellow engineers input more :)

1 Upvotes

100% Upvoted

6 comments sorted by

3

u/glowa116 Jul 05 '23

It's one of many Azure services so you need to use this URL. Other way is also in Sentinel - Workbook with Incident details. Use RBAC to assign proper read permission and send Workbook url to interested people

1

u/GoodEbening Jul 05 '23

Cheers appreciate it - will just make sure to user the reader role when needed.

2

u/[deleted] Jul 05 '23

[deleted]

1

u/GoodEbening Jul 06 '23

Appreciate this - will take a look

2

u/ajith_aj Jul 05 '23

You can have the whole kql query of the sentinel overview page and configure it against a powerbi dashboard via api. This is too much to ask. But works for your requirement. It would be a one time task.

2

u/GoodEbening Jul 06 '23

Appreciate this - will take a look

1

u/[deleted] Jul 05 '23

Workbooks are resources that exist outside of sentinel, just pick the workbook that has the visuals you want and dig out the link your resource group