Every mature Microsoft Sentinel deployment has analysts who live in KQL, a growing SOAR playbook library, and dashboards that security leaders rely on. What many organizations are still missing, however, is Microsoft Sentinel notebooks. Despite being available since the earliest days of Microsoft Sentinel, notebooks remain one of the platform’s most underutilized capabilities for threat hunting, incident investigation, and advanced security analytics.
Microsoft Sentinel notebooks now play an increasingly important role in security operations, supporting data lake analysis, graph-based investigations, machine learning, and large-scale threat detection workflows. This post explains what Microsoft Sentinel notebooks are, how they work, how they integrate with Microsoft Sentinel graphs, and why security teams should pay closer attention to them.
What Are Microsoft Sentinel Notebooks?
Microsoft Sentinel notebooks are Jupyter notebooks. Interactive, browser-based environments that mix executable code, rich text, visualizations, and results in a single scrollable document. Analysts use them to write and run analysis that goes beyond what KQL alone can express. This includes machine learning, custom visualizations, data correlation, anomaly detection, and automated investigation workflows.
The primary programming language is Python. While Jupyter technically supports Julia, R, and other kernels, most Sentinel notebooks, including every template Microsoft ships and virtually everything in the community GitHub repository, are written in Python. That choice makes sense: Python has the deepest ecosystem of data science, machine learning, and security-specific libraries, and it is the language that powers MSTICPy, Microsoft’s own cybersecurity toolkit for Sentinel notebook development.
Microsoft Sentinel Notebooks in the Microsoft Defender Portal
If you are using Microsoft Sentinel in the Defender portal (and you really should be doing that), you will notice two separate notebook entries that do meaningfully different things.
The first is Microsoft Sentinel > Threat management > Notebooks. This is the classic Sentinel notebooks experience. Template-based Jupyter notebooks running in Azure Machine Learning (AML) environments and connected to your Log Analytics workspace via Microsoft’s MSTICPy Python library, which provides tools to obtain, manipulate, and display data.
This is where you find curated threat hunting notebooks, advanced investigation templates, and Microsoft’s Getting Started guidance for Microsoft Sentinel. It is the entry point for analysts who want to run Python-powered investigations against their standard Sentinel data.
The second is the data lake notebooks experience, available through the Microsoft Sentinel Visual Studio Code extension. These notebooks use Python for Apache Spark (PySpark) to interact directly with the Sentinel data lake, the newer, cost-optimized long-term storage tier. Data lake notebooks are built for large-scale data transformation, custom table creation, and graph authoring. They are the authoring environment for custom graphs (more on that below) and for any analysis that needs to span months or years of data. You can view and run these notebooks by going to Microsoft Sentinel > Data lake exploration > Notebooks
Why Microsoft Sentinel Notebooks Go Beyond KQL
The most common question teams ask when evaluating Sentinel notebooks is: “We already have KQL and workbooks, why do we need notebooks?”. The answer is that notebooks provide abilities that KQL does not. For security operations center (SOC) teams, Microsoft Sentinel notebooks enable advanced threat hunting, investigation automation, machine learning, and data enrichment scenarios that would otherwise require multiple disconnected tools.
Machine learning models
Python’s libraries, including PyTorch and TensorFlow ecosystems, are all available in the AML notebook environment. Analysts can train clustering models on Sentinel data to identify peer group anomalies, build sequence classifiers to detect unusual process execution chains, or apply pre-trained threat models to raw log data, none of which is expressible in KQL.
Complex, multi-step investigation workflows
A notebook can chain together dozens of queries, enrichment calls, and decision branches into a reproducible, documented sequence. An analyst investigating a suspected compromise can build a notebook that retrieves all sign-in events for a user, enriches every source IP against threat intelligence, checks for associated device alerts, queries process creation events on relevant endpoints, and renders a timeline. All in one notebook and with every step visible and auditable.
External data integration
Notebooks can reach data sources that have no Sentinel connectors. Including on-premises databases, custom APIs, third-party enrichment services, or data files uploaded directly to the notebook environment. That data can be joined with Sentinel data inside Python and analyzed together.
Custom visualizations
Libraries like matplotlib, bokeh, plotly, and seaborn support chart types and interactivity that workbooks cannot match. Process trees, interactive network graphs, animated timelines, and statistical distribution plots are all straightforward in Python. They can also be embedded directly in the notebook output alongside the analysis that produced them.
Reproducible, shareable investigations
A notebook that has completed is a self-contained document. The queries, the enrichment steps, the analysis code, the visualizations, and the analyst’s written commentary live in one file that can be saved, versioned, shared with colleagues, and re-run against updated data. The final data can be exported as PDF files to share as well. That makes notebooks ideal for recurring investigation tasks, compliance evidence, and institutional knowledge capture.
Notebooks and the Microsoft Sentinel Graph
One of the most significant recent developments in Microsoft Sentinel is the introduction of Microsoft Sentinel graph and custom graphs. Together with Microsoft Sentinel notebooks, these capabilities enable security teams to move beyond traditional log analysis and investigate relationships between users, devices, applications, identities, and attacks at scale.
From Tables to Relationships
The core idea behind Microsoft Sentinel graphs is a shift from table-based to relationship-based security analysis. Traditional SIEM investigations typically involve querying a table, reviewing the results, joining additional tables, and repeating the process as needed. That model works well for finding known patterns but struggles to surface the hidden structural connections that characterize modern attacks. Things like nested group membership chains that lead from a compromised account to a crown-jewel resource, or the multi-hop relationships that link a phishing email through a click, a file download, a process execution, and a lateral movement event are hard to detect using traditional KQL queries.
Sentinel graphs model this data differently. Entities (users, devices, IPs, files, applications, emails) become nodes, and the interactions between them- access events, process spawns, email deliveries, privilege assignments- become edges. Analysts can then query this connected structure using Graph Query Language (GQL), which is fundamentally better at questions like “show me every path between this compromised account and any resource with a crown-jewel sensitivity label” than KQL joins are.
Building Custom Graphs with Notebooks
Custom Sentinel graphs are authored in notebooks. Specifically, in the PySpark notebooks provided by the Sentinel VS Code extension. Analysts use notebooks to define and create custom Sentinel graphs from data lake data. Once created, the graphs are available in the Defender portal, notebooks, and the Graph API.
This means notebooks are not just an investigation tool anymore. They are also the authoring layer for graph-based security infrastructure. A team that builds a custom phishing kill-chain graph (fusing EmailEvents, EmailUrlInfo, UrlClickEvents, DeviceFileEvents, and DeviceProcessEvents) does so in a notebook. They can then schedule that notebook as a recurring job to keep the graph current and then give their analysts a visualization of that attack chain in the Defender portal using GQL.
Why Graphs Matter for Security Teams
Microsoft ships several graph templates for common scenarios. Phishing kill-chain analysis, MITRE ATT&CK behavior mapping, Entra group membership traversal, and Databricks access risk detection. All authored as notebook templates that teams can use as-is or extend as needed.
For Cyclotron clients investing in the Sentinel data lake, custom graphs represent a new capability, and notebooks provide the access. Teams that are comfortable writing and scheduling notebooks are one step away from building investigation infrastructure that surfaces risks through relationship context rather than alert counts.
The Bottom Line
Microsoft Sentinel notebooks remain one of the platform’s most powerful and least-explored capabilities. By combining Python, KQL, Microsoft Sentinel data lake capabilities, and graph-based security analysis, organizations can build more advanced threat hunting, investigation, and detection workflows than traditional SIEM approaches alone.
For security teams that have treated notebooks as an advanced feature for someday, that someday is now. The phishing kill-chain graph that used to require 30–60 minutes of manual multi-table KQL correlation can be modeled once in a notebook, materialized as a scheduled graph job, and traversed in seconds in the Defender portal, by any analyst on the team, without touching code.
Contact Us
Cyclotron helps organizations maximize their Microsoft Sentinel investment through advanced security operations, threat hunting, data lake adoption, and Microsoft Sentinel notebook development.
From MSTICPy configuration and custom investigation workflows to graph-based security analytics, our team helps clients operationalize capabilities that are often overlooked but can significantly improve detection and response outcomes.
If you’re using Microsoft Sentinel and have not yet explored notebooks, you’re likely missing one of the platform’s most powerful capabilities for threat hunting, investigation, and security analytics. Contact Cyclotron to learn how Microsoft Sentinel notebooks can strengthen your security operations and unlock deeper visibility across your environment.