You have an Azure subscription that uses Microsoft Sentinel. You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The…

The correct answer is A. Create an analytics rule. Analytics rules in Microsoft Sentinel run KQL queries on a scheduled basis and automatically generate alerts and incidents when the query returns results matching defined thresholds. Converting a hunting query into an analytics rule is the standard, lowest-effort path to…

Submitted by femi9· Apr 18, 2026Detect and remediate threats using Microsoft Sentinel

Question

You have an Azure subscription that uses Microsoft Sentinel. You detect a new threat by using a hunting query. You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort. What should you do?

Options

ACreate an analytics rule.
BAdd the query to a workbook.
CCreate a watchlist.
DCreate a playbook.

How the community answered

(40 responses)

A
78% (31)
B
3% (1)
C
8% (3)
D
13% (5)

Explanation

Analytics rules in Microsoft Sentinel run KQL queries on a scheduled basis and automatically generate alerts and incidents when the query returns results matching defined thresholds. Converting a hunting query into an analytics rule is the standard, lowest-effort path to automating threat detection - you can promote a hunting query directly to an analytics rule from the Sentinel UI. Workbooks (B) are for dashboards and visualization, not automated detection. Watchlists (C) are reference data lists. Playbooks (D) automate responses to existing alerts but do not perform detection on their own.

Topics

#Microsoft Sentinel#Automated Detection#Analytics Rules#Threat Hunting

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice