Clarification on Scheduling Capability for Azure/Microsoft Sentinel Workbooks

Question

Clarification on Scheduling Capability for Azure/Microsoft Sentinel Workbooks

Chamu Dass Boopathy 0

Do Azure/Microsoft Sentinel workbooks support native scheduling (auto-refresh or timed execution) and/or scheduled report/export generation? If not, what is the Microsoft-recommended approach (e.g., Logic Apps, KQL jobs, Power BI) to achieve scheduled dashboard refresh or periodic snapshots? I am looking for outlook reporting feature the sentinel dasboard on scheduled basis

0 comments

2 answers

Your answer

Answer 1

Microsoft Sentinel workbooks support native data refresh, but they do not provide true scheduled report generation or scheduled email delivery. Workbooks can automatically refresh their data at intervals ranging from 5 minutes to 1 day. However, auto-refresh runs only while the workbook is open in view mode. It is paused while the workbook is being edited and stops when the workbook is closed, so it cannot run in the background and periodically generate a report.

Workbooks also support manual refresh, and the Azure portal provides Print and Save as PDF options. These are manual output functions, however, and there is no native Workbook feature that says, for example, “generate this Sentinel dashboard as a PDF every Monday at 8:00 AM and email it to me through Outlook.”

For Microsoft Sentinel data lake workbooks, the workbook can query the Sentinel data lake directly and render the resulting charts and tables. Because these queries can execute repeatedly when auto-refresh is enabled, you would want to implement query optimization, such as using time filters, summarizing results, and projecting only the columns that are actually required.

For scheduled or timed KQL execution against the Sentinel data lake, the Sentinel-native mechanism is KQL jobs. KQL jobs are asynchronous KQL queries that can be run once or on a schedule. They are intended for scenarios such as long-running investigations, historical scans, anomaly detection, recurring baselines, and moving or promoting data from the data lake to the analytics tier. They support on-demand, daily, weekly, and monthly scheduling.

The important distinction is that KQL jobs schedule the execution of a KQL query - so they do not schedule the rendering, PDF export, or emailing of a Sentinel Workbook. Similarly, Workbook auto-refresh keeps an open dashboard's data current; it does not create a periodic snapshot.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Microsoft Sentinel workbooks support native data refresh, but not true scheduled report generation.

Auto-refresh is supported in workbooks.
- It can be set from 5 minutes to 1 day.
- Auto-refresh runs only while the workbook is open in view mode.
- It is paused during editing.
- It is turned off again when the workbook is closed, so it does not continue running in the background.
Manual refresh is also supported.
Print and Save as PDF are available only in the Azure portal, not as a scheduled export feature.

For Microsoft Sentinel data lake workbooks specifically:

Workbooks can query the Sentinel data lake directly and render charts and tables.
Because workbook visuals can auto-refresh and run many times, query performance guidance is to add time filters, summarize results, and project only needed columns.

For timed execution of queries or periodic data preparation, the Microsoft Sentinel-native approach is KQL jobs:

KQL jobs are one-time or scheduled asynchronous KQL queries on data in the Microsoft Sentinel data lake.
They are intended for scenarios such as:
- long-running investigations,
- historical scans,
- anomaly detection,
- recurring baselines,
- promoting data from the data lake to the analytics tier.
Scheduling frequency for KQL jobs is on-demand, daily, weekly, or monthly.
KQL jobs can be created from Sentinel > Data lake exploration > Jobs.

So the practical guidance is:

Use workbook auto-refresh when an analyst is actively viewing a dashboard and near-real-time refresh is enough.
Use KQL jobs when scheduled backend query execution or recurring historical analysis is needed.
Use workbook Print / Save as PDF only for manual output; the provided material does not describe native scheduled workbook export or snapshot generation.

The provided material does not establish a Microsoft-recommended Sentinel-specific pattern using Logic Apps or Power BI for scheduled workbook snapshot/export. It only supports that workbooks have interactive refresh, and that KQL jobs are the scheduled execution mechanism in the Sentinel data lake.