You have a custom Microsoft Sentinel workbook named Workbook1. You need to add a grid to Workbook1. The solution must ensure that the grid contains a maximum of 100 rows. What should you do?

The correct answer is D. In the grid query, include the take operator. The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows…

Submitted by minji_kr· Apr 18, 2026Create KQL queries for Microsoft Sentinel

Question

Options

AIn the query editor interface, configure Settings.
BIn the query editor interface, select Advanced Editor
CIn the grid query, include the project operator.
DIn the grid query, include the take operator.

How the community answered

(43 responses)

A
5% (2)
B
12% (5)
C
2% (1)
D
81% (35)

Explanation

The take operator allows you to limit the number of rows returned by a query. By including the take operator in the grid query and specifying a maximum of 100 rows, you can ensure that the grid in Workbook1 contains a maximum of 100 rows. https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/takeoperator

Topics

#KQL#Microsoft Sentinel Workbooks#Query Operators#Limiting Results

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice