Skip to content

Commit

Permalink
Added section on notebook sharing (Velocidex#797)
Browse files Browse the repository at this point in the history
Co-authored-by: Mike Cohen <[email protected]>
  • Loading branch information
SBattaglia-R7 and scudette authored Feb 22, 2024
1 parent 5a666bf commit f0c2a49
Show file tree
Hide file tree
Showing 3 changed files with 22 additions and 2 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/gh-pages.yml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
- name: Setup Hugo
uses: peaceiris/actions-hugo@v2
with:
hugo-version: 'latest'
hugo-version: '0.122.0'
# extended: true

- name: Prepare
Expand Down
22 changes: 21 additions & 1 deletion content/docs/vql/notebooks/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ collapse button at the top right of the screen.
{{% /notice %}}


## Hunt and Flow notebooks
## Hunt and Flow Notebooks

Notebooks are an excellent medium to run arbitrary VQL queries. Much
of the time, these queries are used to post process the results from
Expand All @@ -99,3 +99,23 @@ each hunt and a `flow notebook` for each collection. Let's see this
feature in action. I will collect the `Windows.Timeline.Prefetch`
artifact that will build a timeline of the prefetch files on the
endpoint.

## Sharing Notebooks

By default, notebooks are private to the user who created them.
When creating or editing a notebook, you can choose to share it with
all users by clicking the Public check box. You can also share it with
only some users by selecting their names in the Collaborators field.

![Sharing a notebook](notebook_sharing.png)

{{% notice note "Accessing Data in Private Notebooks" %}}
Users can only view notebooks that they own or share.
Other notebooks cannot be accessed from the list view
or via direct link. However, the data within notebooks is still available
to all users. For example, any notebook editor can build or view a
[timeline]({{< ref "/blog/2021/2021-09-07-release-notes-0.6.1/#timelines" >}})
from private notebook cells if they know the notebook and cell IDs. This can
be useful for providing your team with data views that are sourced from more
complex queries maintained in a private notebook.
{{% /notice %}}
Binary file added content/docs/vql/notebooks/notebook_sharing.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit f0c2a49

Please sign in to comment.