What Changed

SOC Handbook v3.0.7 delivers bug fixes and rebranding across five workbooks:

AnalyticsEfficiency.json (primary change):

  • Fixed KQL variable names SecurityIncedentFiltered and incedentAmount – these typos were self-consistent within each query so no runtime failure occurred, but they would break any downstream copy-paste reuse.
  • Removed hardcoded timeContext durationMs 86400000 overrides from several chart items – charts now respect the workbook-level time range parameter instead of being locked to 24 hours regardless of analyst selection.
  • Added Reconnaissance, Resource Development, and Stealth to the MITRE ATT&CK tactics list displayed in the workbook.
  • Bumped workbook version to 1.2.1.

AzureSentinelSecurityAlerts.json, SentinelCentral.json, AnalyticsEfficiency.json: Rebranded legacy Azure Sentinel references to Microsoft Sentinel in display text.

IntsightsIOCWorkbook.json: Removed a redundant nested NotebookGroup wrapper that was causing layout issues.

MITREAttack.json: Corrected tactic mappings.

Operational Note

The hardcoded 24-hour timeContext override is the most operationally relevant fix: analysts using the Analytics Efficiency workbook to review rule performance over custom time windows were silently receiving 24-hour-scoped data regardless of their selection.

Affected Files

Solutions/SOC Handbook/Workbooks/AnalyticsEfficiency.json
Solutions/SOC Handbook/Workbooks/AzureSentinelSecurityAlerts.json
Solutions/SOC Handbook/Workbooks/IntsightsIOCWorkbook.json
Solutions/SOC Handbook/Workbooks/MITREAttack.json
Solutions/SOC Handbook/Workbooks/SentinelCentral.json
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.7.zip, ReleaseNotes.md, Solution_SOC Handbook.json, createUiDefinition.json, mainTemplate.json)