You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day. You need to…

The correct answer is B. bin. Grouping results can also be based on a time column, or another continuous value. Simply summarizing by TimeGenerated, though, would create groups for every single millisecond over the time range, because these are unique values. To create groups that are based on continuous…

Submitted by fatema_kw· Apr 18, 2026Create KQL queries for Microsoft Sentinel

Question

You plan to create a custom Azure Sentinel query that will track anomalous Azure Active Directory (Azure AD) sign-in activity and present the activity as a time chart aggregated by day. You need to create a query that will be used to display the time chart. What should you include in the query?

Options

Aextend
Bbin
Cmakeset
Dworkspace

How the community answered

(16 responses)

A
6% (1)
B
88% (14)
C
6% (1)

Explanation

Grouping results can also be based on a time column, or another continuous value. Simply summarizing by TimeGenerated, though, would create groups for every single millisecond over the time range, because these are unique values. To create groups that are based on continuous values, it's best to break the range into manageable units by using bin.

Topics

#KQL#Azure Sentinel#Data aggregation#Time series

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice