You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecuntyEvent table…

Microsoft Sentinel workbooks are built on Azure Monitor Workbooks and use Kusto Query Language (KQL) to retrieve and visualize data from Log Analytics workspaces. To create a timechart that counts security events by day from the SecurityEvent table, you must add a query component to the workbook. This component will contain the KQL code needed to filter the data for the past week, aggregate the event count by day, and render the results as a timechart.

B. a metric: A metric control is used to display pre-aggregated Azure Monitor metrics, not for querying and aggregating raw log data from a table like SecurityEvent.

C. a group: A group is a layout element used to organize other workbook components, such as queries and text. It does not retrieve or visualize data itself.

D. links or tabs: Links and tabs are navigational and organizational controls within a workbook. They are used to structure the report, not to query or display data.

---

1. Microsoft Documentation - Azure Monitor workbooks query control: "Workbooks allow you to query for data from various sources. ... The query control allows you to get data from these sources to answer questions and visualize that data in your workbooks." This document explicitly states that the query control is used for querying log data sources.

Source: Microsoft Docs

"Azure Monitor workbooks query control"

Section: "Adding a query control".

2. Microsoft Documentation - Visualize and monitor your data with Microsoft Sentinel workbooks: "Azure Monitor Workbooks provides a flexible canvas for data analysis and the creation of rich visual reports... They allow you to tap into multiple data sources from across Azure... Microsoft Sentinel allows you to create custom workbooks from your data... by querying your data from your tables in your workspace."

Source: Microsoft Docs

"Visualize and monitor your data"

Section: "Create a new workbook".

3. Microsoft Documentation - Azure Monitor workbooks visualizations - Charts: "Workbooks can convert log query results into various chart formats... The query must return at least two columns: a text column for the categories and a numeric column for the values." This confirms that a query is the source for chart visualizations.

Source: Microsoft Docs

"Azure Monitor workbooks visualizations"

Section: "Charts".