UPDATE: It appears that Microsoft has removed this from Workbooks, at least for the time being. It may be that it is not ready for release yet or it could be that it was re-enabled by accident. Hopefully it will show up again since I can see this being quite useful.
Overview
While working on my new book about workbooks, I noticed that there is a new step type that is only available in the Defender portal called “repeater”. It is pretty interesting, so I thought I would talk about it a bit here.
Not only can you add step(s) for each row, but you can also add step(s) that get processed before the rows, as delimiters for the rows, and after the rows are shown.
Repeater
The “Repeater” step does exactly what the name says. It will create an entry for each row returned from either the data (seems that the old “Query” step has been modified as well) or Params (although I have not been able to get this to work so I am not sure what it should do).
First, add a new “repeater” step and select the way you want it to look. Select either “Flat”, “Tabs”, or “Pagination”. In the image below, I added a “Flat” look.
Then you need to mouse-over this step and select “Edit repeater”. Once you have that selected, you can select to get your information from either an existing Data result or Params (again, I have not gotten this part to work). You will need to have a data source already added before the repeater step, so it knows that there is some data. In the following examples, I added a repeater under the “Incidents created over time” step in the “Security Operations Efficiency” workbook.
In the image below, I have selected to loop over “Data” and in the “Data settings” box, I selected the “Incidents over time” data source.
I did not select to create an index parameter, but if you need to know which row you are on, enable that. It will default the parameter name to “Index” and the starting value to “1”. Adjust as needed.
If you want to limit how many rows are used in the repeating loop, enable the “Use limit” checkbox and set the limit. In this case, I enabled it and used the default value of 100.
Notice that the “Test” box is empty. This is because there is nothing setup for the “repeat” section. Click the “Done Editing” button to save your changes and then it will revert to what you see in Figure 1.
There are four different sections you can fill in:
- repeat – These step(s) will repeat once for each row returned in your selected data source
- pre – These step(s) will execute before the “repeat” section
- post – These step(s) will execute after the “repeat” section
- delimiter – These step(s) will execute between each row in the “repeat” section.
Fill these out as needed. Keep in mind, that you will need to know what parameters are being returned from your data source. Don’t forget to surround your parameter name with “{}”
One thing I have been doing is to add a “Text” step in the “repeat” section and add the parameter I am interested in as shown below.
You will need to save this step, the repeater, and the workbook in order to see the results as shown below (pretty boring picture)
Summary
I really wanted to show you how it looked with everything filled out, but it seems that I broke Microsoft Sentinel and I can no longer edit workbooks! Hopefully this isn’t because of the repeater step itself.
I can see repeaters being quite useful when everything is working correctly and hopefully that will be soon 🙂