This demo (one of many) puts Microsoft Sentinel Jupyter Notebooks to work by querying, enriching, shaping, and writing data in the Sentinel data lake. It reads the previous seven days of SigninLogs from an analytics table mirrored into the lake, then queries unique EntraUsers from the Assets system tables. Using the Microsoft Sentinel data provider, the notebook joins both data frames on userPrincipalName, converts results with the Pandas Python library, and displays the enriched data through Data Wrangler. The walkthrough then uses save_as_table to write grouped results into a data lake system table with an _SPRK suffix, explains how the call would differ when writing to the analytics tier, and closes by exploring built-in notebook samples—including Tutorials and an enterprise PasswordSpray example.
We approached this edit like the data workflow itself: pull in the strongest material, join the right pieces, and remove anything that failed to enrich the result. The demo recordings were organized into a visible progression from reading data to joining it, inspecting it, and writing it back—making the code’s purpose apparent even to viewers who have not yet developed strong feelings about data frames. Studio-recorded voiceover explains each operation in plain language, while visual emphasis and measured pacing give viewers time to connect the code with its output. Dense material. Nicely unpacked.
The inevitable sequels
Hollywood keeps stretching good ideas into progressively worse sequels. We don’t. These are the related videos—spiritual siblings of the one you just watched—as good or better than this video. Expect callbacks, new plot twists, and maybe even a scene-stealing cameo from a lower third.
