In general KQL's let statement does what I'm looking for, but that doesn't work in a Sentinel workbook. I want to have an initial query that gets me a list of SecurityIncident results. Then I want to have several other queries that visualize the data, each joining with other tables.

For example, I want at the top a list of URL click incidents. Below that I want a list of all mailMessage entities involved from those incidents. I also want lists for all UrlClickEvents sharing those NetworkMessageIds. I also want to see just the distinct domains from those click URLs, etc. etc. I want this to be a useful workbook.

The only way to accomplish this that I've succeeded with is to repeat the same initial query in my next queries, as let statements. But this way I'm doing the same initial big query multiple times. It feels wrong to make a workbook that does the same query like 10 times when it should only have to happen once.

It seems like adding a parameter that gets its values from a query is the way to go, but there are only 3 documented ways to do that, and they're limited to 1 or 2 columns only.