You have a Microsoft Sentinel workspace.

When you create a Microsoft Sentinel workbook that visualizes data retrieved using a Kusto Query Language (KQL) query, the workbook must use a data source that supports log analytics queries. According to Microsoft Sentinel and Azure Monitor documentation, Logs (Analytics) is the correct data source type for querying tables stored within a Log Analytics workspace , such as the SecurityIncident table. This table is where Microsoft Sentinel stores incident data.

In the workbook configuration, the Resource type determines which service the query context applies to. Since you are querying Microsoft Sentinel incidents (not general Azure Monitor logs or metrics), you must set the resource type to Microsoft Sentinel . This ensures that the workbook is connected to Sentinel’s analytics schema and can display visualizations (charts, metrics, timelines) based on Sentinel’s native data tables.

Alternative resource types such as Log Analytics or Workspace could technically access the same data, but Microsoft Sentinel doc umentation recommends selecting Microsoft Sentinel when the workbook is designed for security operations and incident analysis. This provides tighter integration with the SOC dashboard experience, Sentinel permissions, and security insights views.

✅ Theref ore, the correct selections are:

Data source: Logs (Analytics)

Resource type: Microsoft Sentinel