Lets a threat hunter keep a Microsoft Sentinel query result, along with notes, entity mappings and MITRE ATT&CK tags, then attach it to an existing incident or raise a fresh incident from it.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Bookmark in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.
- Entity
Something like a product or customer that an organisation stores data about. Its characteristics are its attributes, and every individual record is one instance.
- Image tagging
An Image Analysis feature producing single-word tags, each with a confidence score, for actions, scenery, objects and living things in an image.
- Incident
A case that Microsoft Defender XDR or Microsoft Sentinel builds by correlating several alerts that look like parts of one attack. It lists the assets involved and the evidence, and analysts can assign it and update its status as they investigate.
Related terms
- Bookmark navigator
A ready-made navigation element that creates a button for every bookmark in a report or in a chosen bookmark group. Its buttons update automatically when bookmarks are added, renamed or put in a different order.
- Data asset
In Azure Machine Learning, a versioned, named pointer to a storage location (
uri_file,uri_folderormltable) that behaves like a bookmark, leaving the data where it is rather than copying it. - HuntingBookmark
Sentinel saves hunting bookmarks in this Log Analytics table. A bookmark you delete isn't removed; its row remains with SoftDelete marked true.
- PBIR
Power BI Projects' documented report format, which gives each page, visual and bookmark a JSON file of its own. It has become the default, superseding PBIR-Legacy.