According to Microsoft Sentinel documentation, notebooks integrate with Azure Machine Learning and Jupyter to allow advanced data visualization, enrichment, and correlation with third-party data sources.
Notebooks are used by security analysts and threat hunters to perform deep investigations by combining Sentinel data (such as logs, alerts, and incidents) with external threat intelligence feeds, indicators of compromise (IoCs), and custom datasets.
Microsoft describes notebooks as:
"A powerful tool built on Jupyter and Azure Machine Learning that allows you to use Python code to enrich Microsoft Sentinel data with external data sources, visualize data, and identify patterns and IoCs." They allow analysts to query, visualize, and correlate data interactively, going beyond the built-in dashboards and KQL-based analytics.
Thus, to visualize Sentinel data and enrich it with third-party IoC data, Notebooks in Azure Sentinel is the correct solution

Explanation:

Reference:
https://techcommunity.microsoft.com/t5/azure-security-center/security-control-restrict-unauthorized-network-access/ba-p/1593833
https://techcommunity.microsoft.com/t5/azure-security-center/security-control-secure-management-ports/ba-p/1505770

When authoring a custom plugin for Copilot for Security that queries security telemetry and returns structured results, the expected query/target format is Kusto Query Language (KQL). Copilot for Security integrates with Microsoft security data platforms (Microsoft Sentinel/Log Analytics and Defender tables) where investigative and hunting queries are expressed in KQL. Official plugin examples and guidance show the plugin invoking a KQL query against a workspace or a Defender table and returning the results in the plugin response payload. KQL is the language used to interrogate event, alert, and entity tables (for example, DeviceProcessEvents, SecurityAlert, MicrosoftGraphActivityLogs) and is the supported format when a plugin's purpose is to retrieve and return telemetry to Copilot for Security. Other formats listed (API, GPT, SQL) are not the standard query language for Defender/Sentinel data: APIs are endpoints for programmatic access, GPT is a model format, and SQL is not used for Azure Monitor / Sentinel tables. Therefore when the plugin's <target> must specify the query format against security telemetry, KQL is the correct choice.