SC-200 · Question #287
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following…
The correct answer is A. a query. A query allows you to retrieve specific data from the SecurityEvent table. You can write a query that filters events based on the past week’s timestamp and aggregates the count of events by day. The timechart visualization will display this aggregated data over time, showing…
Question
You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements:
- Identify the number of security events ingested during the past week.
- Display the count of events by day in a timechart.
What should you add to Workbook1?
Options
- Aa query
- Ba metric
- Ca group
- Dlinks or tabs
How the community answered
(53 responses)- A89% (47)
- B2% (1)
- C8% (4)
- D2% (1)
Explanation
A query allows you to retrieve specific data from the SecurityEvent table. You can write a query that filters events based on the past week’s timestamp and aggregates the count of events by day. The timechart visualization will display this aggregated data over time, showing the event count
Topics
Community Discussion
No community discussion yet for this question.