You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution…

The correct answer is B. union kind = inner. KQL, union operator Takes two or more tables and returns the rows of all of them. [ T | ] union [ UnionParameters ] [kind= inner|outer] [withsource= ColumnName] [isfuzzy= true|false] Tables https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/unionoperator

Submitted by luis.pe· Apr 18, 2026Manage threat mitigation using Microsoft Defender for Endpoint

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Endpoint. You need to create a query that will link the AlertInfo, AlertEvidence, and DeviceLogonEvents tables. The solution must return all the rows in the tables. Which operator should you use?

Options

Asearch *
Bunion kind = inner
Cjoin kind = inner
Devaluate hint.remote =

How the community answered

(35 responses)

A
3% (1)
B
91% (32)
D
6% (2)

Explanation

KQL, union operator Takes two or more tables and returns the rows of all of them. [ T | ] union [ UnionParameters ] [kind= inner|outer] [withsource= ColumnName] [isfuzzy= true|false] Tables https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/unionoperator

Topics

#KQL#Defender for Endpoint#Querying data#Table operators

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice