Open with

In the source document, select the items that you want to copy to another document.

You can select multiple items simultaneously if you want to open them all in another app.

Select > Open with.

In the Open with… window, select the action/application into which you want to copy the selected items.

The Open with options available varies depending on the apps you have installed.

In Select destination, select an existing document or create a new one.

Select Add.

The selected application opens with the selected section copied into it.

In the notebook, select the notebook section that you want to copy to a dashboard.

Select > Open with.

In the Open with… window, select the Dashboards option.

A Select destination box is displayed.

In Select destination, you can create a new dashboard or select an existing dashboard.

Select Add.

The dashboard opens with the selected section copied into it.

In the dashboard, select the tile that you want to copy to a notebook.

Select > Open with.

In the Open with… window, select the Notebooks option.

A Select destination box is displayed.

In Select destination, you can create a new notebook or select an existing notebook.

Select Add.

The Dashboards application opens with the selected section copied into a new or existing dashboard (depending on what you chose in Select destination).

In the dashboard, select the query tile that you want to copy to a workflow.

Select > Open with.

In the Open with… window, select the Automate DQL Query Workflows option.

A Select destination box is displayed.

In Select destination, you can create a new workflow or select an existing workflow.

Select Add.

The Workflows application opens with the selected query added as a workflow task.

Edit the workflow as needed.

In this example, we have a dashboard tile that queries vulnerability data to list vulnerabilities of type Blind XPath Injection.

fetch events
| filter event.kind == "SECURITY_EVENT"
| filter event.type == "VULNERABILITY_STATE_REPORT_EVENT"
| filter event.level == "VULNERABILITY"
| filter contains(vulnerability.type, "Blind XPath Injection")
| summarize {
   vulnerability.display_id = takeAny(vulnerability.display_id),
   vulnerability.title = takeAny(vulnerability.title),
   vulnerability.risk.level = takeFirst(vulnerability.risk.level),
   vulnerability.risk.score = takeFirst(vulnerability.risk.score),
   vulnerability.references.cve = takeFirst(vulnerability.references.cve),
   affected_entities.vulnerable_components.names = takeFirst(affected_entities.vulnerable_components.names)
   }, by: {vulnerability.id}
| sort vulnerability.risk.score desc

Example results:

In the results, select the ID (example: 8721651230953759262) or the display ID (example: S-4174) of a vulnerability for which you want to see details and select Open.

In the Open with… window, select the View vulnerability option.

The vulnerability details page is displayed for the selected vulnerability.