You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center. You need to create a query that will be used to…

The correct answer is C. count. To produce a bar graph in Azure Sentinel (using Kusto Query Language / KQL), the query must aggregate data using the 'count' function (e.g., 'summarize count() by AlertName') and then use 'render barchart'. The 'count' operator is what produces the numeric values that form the…

Submitted by dimitri_ru· Apr 18, 2026Create KQL queries for Microsoft Sentinel

Question

You plan to create a custom Azure Sentinel query that will provide a visual representation of the security alerts generated by Azure Security Center. You need to create a query that will be used to display a bar graph. What should you include in the query?

Options

Aextend
Bbin
Ccount
Dworkspace

How the community answered

(50 responses)

A
2% (1)
B
4% (2)
C
92% (46)
D
2% (1)

Explanation

To produce a bar graph in Azure Sentinel (using Kusto Query Language / KQL), the query must aggregate data using the 'count' function (e.g., 'summarize count() by AlertName') and then use 'render barchart'. The 'count' operator is what produces the numeric values that form the bars in the chart. The 'extend' operator adds computed columns but does not aggregate. The 'bin' operator groups time intervals and is used for time-series charts, not bar charts. The 'workspace' keyword queries across workspaces and is unrelated to chart rendering.

Topics

#KQL#Azure Sentinel#Querying#Aggregation

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice