At least one workbook is deployed in every Microsoft Sentinel workspace for visualization and operational reporting

Overview

Workbooks are Sentinel’s primary visualization surface for SOC operations: they aggregate KQL queries against the workspace into curated dashboards (Microsoft Entra audit, Azure Activity, Office 365, Microsoft Defender XDR, data-collection health, identity-and-access, threat intelligence, security operations efficiency) so analysts can perform trend analysis, hunt visually, monitor connector health, and brief leadership with consistent metrics. Without workbooks, the SOC has no executive view, no longitudinal trend dashboards, and no visual entry point into the workspace; analysts revert to ad-hoc KQL, which slows investigation and increases the chance that a slow-burn pattern indicating a threat actor in the persistence or collection phase is missed. Workbooks are also the documented vehicle for Microsoft-published health-monitoring dashboards (Data Collection Health, Microsoft Sentinel Cost, Workspace Audit) that surface degradations in detection capability before they become detection gaps. The check confirms at least one workbook is deployed; production deployments typically install the recommended workbook set per the customer’s connector inventory.

Remediation

• Visualize collected data with Microsoft Sentinel workbooks
• Deploy Microsoft Sentinel content from the content hub

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.