↳ GitHub sourceWorkbook

User Map information

Description

This Workbook shows MaliciousIP, User SigninLog Data (this shows user Signin Locations and distance between as well as order visited) and WAF information.

Version: 1.0.1
Declared author / publisher: Microsoft Sentinel Community

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureActiveDirectory

Data types

SigninLogs AzureDiagnostics WireData VMconnection CommonSecurityLog WindowsFirewall W3CIISLog DnsEvents

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Workbooks/UserMap.json ↗
Commit: 9800e51 ↗
Source identifier: UserMap

Additional source files 2

Workbooks/UserMap.jsonsource ↗Workbooks/WorkbooksMetadata.jsonworkbook-metadata ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.