Create IncidentsPerDepartmentWorkbook

[ZaidAlKhayyat-MSFT]

This workbook extracts Incidents and alerts based on the department tag attached to VMs hosted on Azure. It extracts hosts from alerts and tag from ARG then correlates it with the incidents. Azure VMs tags are uploaded using Watchlist on Sentinel.

Required items, please complete

Change(s):

• New idea deployment

Reason for Change(s):

• New idea deployment

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• I have tested the KQL queries.

---

[ZaidAlKhayyat-MSFT]

@microsoft-github-policy-service agree

[v-atulyadav]

Hi @ZaidAlKhayyat-MSFT,

Could you please update the metadata for the workbook located at the path mentioned below? Let me know if you need help with the specific values or format. Thanks

https://github.com/Azure/Azure-Sentinel/blob/master/Workbooks/WorkbooksMetadata.json

[v-atulyadav]

Hi @ZaidAlKhayyat-MSFT,
Any update on the request mentioned above? Thanks

[v-atulyadav]

Hi @ZaidAlKhayyat-MSFT,
We are still awaiting your response. Thanks

[v-atulyadav]

Hi @ZaidAlKhayyat-MSFT,
We are still awaiting your response. Kindly provide an update at your earliest convenience. Thanks