2.1.3. Workbooks and SOC Optimization

💡 First Principle: A SOC needs two kinds of feedback about itself: what is the data telling us? and are we using our data and rules well? Workbooks answer the first by turning KQL into interactive dashboards; SOC optimization answers the second by analyzing your own ingestion and detection coverage and recommending specific changes.

Workbooks are built on Azure Monitor workbooks. Each one is a set of KQL-driven visualizations (charts, grids, tiles), text, and parameters such as a time-range picker. They come from two places: templates, installed with Content hub solutions (the Microsoft Entra ID solution, for example, brings sign-in and audit workbooks), and custom workbooks you build from scratch. A template is read-only; selecting Save creates your own workbook resource in the workspace's resource group, which then appears under My workbooks and can be edited. Before saving a template, check its required data types, because a workbook is only as good as the tables it queries. Workbooks live under Threat management > Workbooks; some visualizations still open in the Azure portal from the Defender portal.

Permissions follow 2.1.1: Workbook Reader to view, Workbook Contributor to create, edit, or delete when the user holds only Sentinel Reader or Responder (Sentinel Contributor already includes workbook authoring). Auto refresh is available (5 minutes to 1 day) but is off by default. Microsoft recommends building workbooks on ASIM parsers (the Advanced Security Information Model's normalized schemas) rather than raw tables, so the same workbook works across different vendors' data.

SOC optimization is a recommendations engine that runs against your own environment and recalculates every 24 hours. Recommendations fall into three families:

• Data value recommendations find tables you pay to ingest but barely use for detection, and suggest acting on it: either use the data (add rules) or change its plan or tier to cut cost.
• Coverage recommendations find gaps. Threat-based recommendations compare your active rules against the detections Microsoft recommends for specific attack scenarios (for example, human-operated ransomware or business email compromise) and rate coverage as High (over 75% of recommended rules active), Medium (30–74%), or Low (under 30%). Other coverage types include AI MITRE ATT&CK tagging recommendations and risk-based recommendations (both in preview).
• Similar organizations recommendations suggest data sources and detections that organizations with a similar profile use.

Each recommendation shows the observation behind it and offers actions such as Go to Content hub to install rules, Change plan for a table, or View full threat scenario. You manage recommendations with statuses: Active (default), In progress, Completed (set manually or automatically when your environment changes), and Dismissed. SOC optimization uses standard Sentinel roles and works best with Sentinel onboarded to the Defender portal, where its recommendations cover Microsoft security services more broadly.

⚠️ Exam Trap: "Identify tables that cost the most but provide little detection value, with the least administrative effort" is SOC optimization's data value recommendations, not a custom workbook you build yourself. "Determine whether the organization has enough active detections for ransomware" is a threat-based coverage recommendation.

Reflection Question: SOC optimization flags a large proxy log table as low data value. Describe two opposite ways to act on that recommendation, and what business question decides which one is right.