You have a Microsoft Sentinel workspace. You have a query named Query1 as shown in the following exhibit. You plan to create a custom parser named Parser1. You need to use Query1 in Parser1. What…

Question

Exhibit

Options

• ARemove line 5.
• BRemove line 2.
• CIn line 3, replace the !contains operator with the !has operator.
• DIn line 4, remove the TimeGenerated predicate.

• A
  7% (2)
• B
  72% (21)
• C
  3% (1)
• D
  17% (5)

Explanation

ASIM (Advanced Security Information Model) parsers in Microsoft Sentinel must conform to a specific structure to function correctly as reusable KQL functions. A common incompatibility is the presence of a 'let' statement or query preamble (such as a time filter or workspace reference) that should not appear in a parser definition. Line 2 in the shown query contains such an incompatible element - most likely an explicit time range filter or a 'set' directive - that would break the parser when called as a function, since the calling query controls the time scope. Removing line 2 makes the query compatible with the ASIM parser model. The other options (removing line 5, replacing !contains with !has, or removing the TimeGenerated predicate in line 4) do not address the structural requirement that prevents the query from being used as a parser.

No community discussion yet for this question.