You have a Microsoft Sentinel workspace that contains the following incident. Brute force attack against Azure Portal analytics rule has been triggered. You need to identify the geolocation…

Question

Options

• AFrom Overview, review the Potential malicious events map.
• BFrom Incidents, review the details of the iPCustomEntity entity associated with the incident.
• CFrom Incidents, review the details of the AccouncCuscomEntity entity associated with the incident.
• DFrom Investigation, review insights on the incident entity.

• B
  78% (14)
• C
  17% (3)
• D
  6% (1)

Explanation

For a brute force attack against the Azure Portal, the incident in Microsoft Sentinel will have an IP address entity (iPCustomEntity) representing the attacking source. When you review the details of this IP entity from the Incidents blade, Sentinel enriches it with geolocation information - including country, city, and coordinates - sourced from threat intelligence. This is the correct path to find geolocation data. Option A (Potential malicious events map on Overview) shows a broad geographic overview but is not tied to a specific incident. Option C references an AccountCustomEntity, which contains user account data, not geolocation. Option D (Investigation insights) provides entity relationship graphs but is not the primary source for geolocation detail.

No community discussion yet for this question.