Lesson 20 — Microsoft Sentinel Notebooks

Learning objectives

After completing this lesson, you should understand how Microsoft Sentinel Notebooks extend advanced investigation and hunting workflows.

• Explain what a Jupyter Notebook is.
• Understand when to use KQL and when to use a Notebook.
• Recognise the role of Python and MSTICPy.
• Use Notebooks for enrichment, visualisation and repeatable analysis.
• Understand permissions, credentials, governance and cost considerations.

The problem this solves

Some investigations require more than one query or one table.

Notebooks let analysts combine many steps, data sources, code blocks, notes and visualisations into a repeatable workflow.

Jupyter Notebooks

Jupyter provides the interactive notebook format used for code, text and visual output.

Analysts can run cells individually, inspect results and refine the investigation step by step.

Python

Python is commonly used in Sentinel Notebooks for data processing, enrichment, visualisation and automation.

It gives analysts access to a broad ecosystem of libraries for working with security data.

MSTICPy

MSTICPy is a Microsoft security investigation and threat hunting library for Python.

It can help query data, enrich indicators, analyse entities, build timelines and visualise investigation results.

KQL versus Notebooks

KQL is usually the fastest tool for querying and summarising Sentinel data.

Notebooks become useful when the investigation needs multiple stages, external enrichment, custom visualisation or reusable analysis logic.

Use KQL when

• You need a quick query.
• The data already exists in Sentinel.
• You are filtering, summarising or joining tables.
• You want to create an analytics rule or hunting query.

Use a Notebook when

• The workflow has many investigation steps.
• You need external enrichment.
• You need custom charts or relationship analysis.
• You want the investigation to be repeatable and documented.

Threat intelligence enrichment

Notebooks can enrich IP addresses, domains, URLs, hashes and other indicators using approved intelligence sources.

Record the source, confidence and time of each enrichment result.

Visualisation

Notebooks can create timelines, charts, graphs and tables tailored to the investigation.

Visual output should support the evidence rather than replace it.

Reusable workflows

A well-designed Notebook can become a repeatable investigation procedure.

Parameters can allow another analyst to run the same workflow for a different account, incident or indicator.

Documentation

Use markdown cells to explain the hypothesis, data sources, assumptions, findings and limitations.

This makes the investigation easier to review and hand over.

Credentials and secrets

Do not store passwords, API keys or tokens directly inside Notebook code.

Use secure authentication methods, managed identities or approved secret storage where available.

Permissions

Notebook users and compute identities should only receive the access required for the investigation.

Least privilege reduces the risk of exposing security data or allowing unintended actions.

Compute and cost

Notebook environments may use compute resources that generate cost.

Stop or remove unused compute, review workspace policies and understand how the selected environment is billed.

Common mistake

A common mistake is using a Notebook for a task that one clear KQL query could solve.

Choose the simplest tool that provides reliable and repeatable evidence.

Best practices

• Start with a clear investigation hypothesis.
• Use parameters instead of hard-coded values.
• Keep secrets out of the Notebook.
• Document data sources and assumptions.
• Test the workflow before relying on it operationally.

Agent Foskett takeaway

Microsoft Sentinel Notebooks extend KQL-driven investigations with code, enrichment, visualisation and repeatable workflows.

They are most valuable when the analysis is too complex for one query but still needs to remain transparent and reproducible.