You have an Azure Sentinel deployment. You need to create a scheduled query rule named Rule1. What should you use to define the query rule logic for Rule1?

Question

Options

• Aa Transact-SQL statement
• Ba JSON definition
• CGraphQL
• Da Kusto query

• B
  4% (1)
• C
  4% (1)
• D
  92% (24)

Explanation

Explanation

Azure Sentinel (now Microsoft Sentinel) uses Kusto Query Language (KQL) as its native query language for defining scheduled analytics rules, including the logic that detects threats and anomalies in your log data. KQL is the standard query language across Microsoft's monitoring and security platforms, including Log Analytics, Microsoft Defender, and Sentinel, making it the required choice for defining rule logic.

Why the distractors are wrong:

• A (Transact-SQL): T-SQL is used for Microsoft SQL Server relational databases, not Azure Sentinel's log analytics platform.
• B (JSON): While JSON is used for exporting or importing rule definitions as ARM templates, it is not used to define the actual query logic within the rule.
• C (GraphQL): GraphQL is a data query language designed for APIs (commonly used with web services), and has no role in Azure Sentinel analytics rules.

Memory Tip

Think "K for Kusto, K for cloud security platform" - any time an exam question involves querying logs in Azure Monitor, Log Analytics, or Microsoft Sentinel, the answer will almost always be KQL (Kusto Query Language). Recognizing this pattern across multiple Azure services will help you quickly eliminate other options.

No community discussion yet for this question.