Create a Workbook
  • 5 Minutes to read
  • Contributors
  • Dark
  • PDF

Create a Workbook

  • Dark
  • PDF

Workbooks can be used to process information for investigations, auto-detection and profiling using various blocks such as Search, DQL, Code, Text, and Visual etc. You can identify or investigate events or observations that raise a suspicion and can also automate these queries to run at an interval or on demand as per requirement.

  • Workbooks are an elegant way to run jobs without the hassle of writing the same queries repeatedly.

  • A single workbook can have multiple blocks and these multiple blocks will be automatically executed one after the other. A workbook with multiple blocks will be considered as a single use case.

  • A workbook with multiple queries can be saved and used as an input for another workbook. i.e. you can call a workbook from another workbook.

  • The workbook comprises of the following blocks:

    • DQL Block: Used to manually write DQL queries, multiple DQL Blocks can be added in a Workbook.
    • Search Block: Used to build DQL queries by selecting the predefined directives, filters, functions etc
    • SQL Block: Used to manually write queries in SQL.
    • Code Block: You can write a python code to manipulate the data and generate a new output using python.
    • AI Block: To accelerate and automate the process of identifying a potential threat by adding the identified incident as a signal.
    • Visualization Block: The visualization block will display the result of the queries executed in a graph or chart format.
    • Text Block: Used to write descriptions, steps, use cases for the workbook that helps you to understand everything about workbook
      The editor supports markdown format.
    • Signal Block: Signals are triggered via Workbooks i.e. as per the logic set in its query. On executing a query via workbook and if there are any threat related data such as types of attacks etc, a signal will be triggered

Workbooks can be scheduled on an on-demand basis or streamed at a definite interval as per requirement.

How to view Workbooks?

  • Hover on the Workbooks icon on the left navigation bar, it will display the folder wise view of existing workbooks in the cluster.


The following fields appear in the workbook list:

Field Name Description
Workbook Name The name of the workbook
Author The name of the user who created the workbook
Cost The approximate cost incurred to process a workbook
Last Run The last time stamp when the workbook was executed
Duration The duration taken to process a workbook
Import Used to import workbooks
image.png Indicates that the workbook is scheduled
image.png Click this to delete the specific workbook
image.png Indicates the Workbook is streamed.
image.png Used to create a new workbook
image.png Used to search for an existing workbook
image.png Used to refresh and display the updated workbook list

Native Workbook

Native workbooks are workbooks authored by Community and DNIF, the native tag will be displayed on opening these workbooks and users will not be able to edit these workbooks. Now DNIF allows users to clone these native workbooks and you can make the required changes in the cloned version.

How to clone a native workbook?

To clone a native workbook, open a workbook and click Save, a pop up window with multiple options is displayed.


The following options are displayed

  • Disable existing workbook: This option is enabled by default. On enabling this option the original workbook is disabled and the new clone of the workbook will be enabled. You can modify the required changes in the cloned workbook.
  • Retain the schedule: A native workbook can be a standard/Scheduled/Streamed workbook. Enabling this option will create the new workbook as per the existing schedule and disabling this option will create a standard workbook. To create a new schedule, refer Schedule a workbook
  • Workbook Name: Workbook name for the cloned workbook is automatically generated and custom is added to the existing name by default.You can also edit the name and provide a name as per your requirement.

Click Save, this will save a new version of the current native workbook and the new workbooks will be displayed on screen.

On the workbook list page, both the new and existing workbooks will be listed and if you have enabled the Disable existing workbook option, the existing native workbook will appear as disabled in the list. The disabled workbooks will not execute as per the schedule or stream; it will not be invoked in the disabled state.

You can also disable or enable workbooks from the list page. To enable or disable, select a particular workbook and the following bar will be displayed.


In this case when you disable a workbook only the invoke is stopped and the cron is maintained so when you enable the workbook again, it will be enabled again along with the cron.

How to create a Workbook?

  • Click the search icon on the left navigation bar or click the plus icon at the top right corner of the Workbooks list page to create a new workbook, the following screen is displayed.


  • To edit the workbook name click /drafts/ Untitled Workbook on the top left corner of the screen and enter a name of your preference.

    • The first part of the Workbook name indicates the folder where the workbook will be saved. You can also create your own folder by clicking the plus sign at the end of the folder list.
  • Click the plus icon on this page to add the required blocks to your Workbook.


  • The first Block to be added in a Workbook should always be a Search Block / DQL Block / SQL / Text Block.

  • Code, Signal, Visualization Blocks can be added only after adding a Search Block / DQL Block

  • All query results will be retained only for an hour.

  • Once you have added all the required blocks in the Workbook. Click Save, to save your Workbook.

Workbook Functions

The following table describes the various icons on the Workbook page.

Field Description
image.png Used to add Workbook parameters
image.png Used to revoke the executed query.
image.png Used to save the Workbook
image.png Delete a Workbook
image.png Used to download a Workbook
image.png Used to schedule a Workbook
Introduced in v9.1.1

UNET sync is a process that is running on core and it automatically syncs your workbooks every 30 minutes.

Was this article helpful?