You have an Azure subscription that contains a virtual machine named VM1. You are creating a data collection rule (DCR) named DCR1 that will collect events from VM1. You need to ensure that only…

The correct answer is B. an XPath query. Collect Windows events from virtual machine with Azure Monitor Filter events using XPath queries The basic configuration in the Azure portal provides you with a limited ability to filter events based on log and severity. To specify more granular filtering, use custom…

Submitted by anna_se· Mar 6, 2026Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel

Question

You have an Azure subscription that contains a virtual machine named VM1. You are creating a data collection rule (DCR) named DCR1 that will collect events from VM1. You need to ensure that only events that have an ID of 4798 are collected. What should you use in DCR1?

Options

Aa PowerShell script
Ban XPath query
Ca KQL query
Da T-SQL query

How the community answered

(39 responses)

A
15% (6)
B
77% (30)
C
5% (2)
D
3% (1)

Explanation

Collect Windows events from virtual machine with Azure Monitor Filter events using XPath queries The basic configuration in the Azure portal provides you with a limited ability to filter events based on log and severity. To specify more granular filtering, use custom configuration and specify an XPath that filters for only the events you need. XPath entries are written in the form LogName!XPathQuery. For example, you might want to return only events from the Application event log with an event ID of 1035. The XPathQuery for these events would be [System[EventID=1035]]. Because you want to retrieve the events from the Application event log, the XPath is Application![System[EventID=1035]] https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events'

Topics

#data collection rules#XPath query#Windows event filtering#Azure Monitor

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice