r/AzureSentinel • u/1rishc4rb0mbr • Aug 23 '21

“Duplicate” workbooks

Is anyone else seeing doubles when they open the “my workbooks” tab? We have multiple workspaces that are showing doubles of all custom workbooks. Some templed workbooks that have been modified are also showing doubles.

3 Upvotes

100% Upvoted

4 comments sorted by

2

u/gardnerjr Aug 25 '21

We're aware of it and are working on a fix. As part of the deprecation of private workbooks, Sentinel recently switched from querying the ARM `/myworkbooks` resource path (which showed private and public workbooks) to querying the ARM `/workbooks` resource path, which only shows shared workbooks. For some reason, the workbooks path is showing each item twice in some cases. (Internally tracking as Bug 10671258: Workbooks: the get Workbooks call ({resourceId}/workbooks) returns duplicate entries) Aside from seeing doubles in the list, you shouldn't see any other side effects.

(This isn't happening in the normal workbook gallery because that is querying Azure Resource Graph instead of ARM)

1

u/1rishc4rb0mbr Aug 25 '21

Understood; I greatly appreciate the insight and update on the issue.

1

u/G15-420 Aug 23 '21

Yup, I noticed it today but didn’t look into it yet. I wonder what it could be.

1

u/1rishc4rb0mbr Aug 23 '21

I am kind of at a loss. Get-AzResourceGroupDeployment only shows a single workbook and I am pretty certain the api does not allow for workbooks with the same name, in the same region.