SC-200 · Question #318
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the…
The correct answer is C. a scheduled query rule. To ensure an incident is automatically created in Microsoft Sentinel when a new attack vector identified by a custom hunting query is detected, a scheduled query rule must be configured.
Question
You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database. You need to ensure that an incident is created in WS1 when the new attack vector is detected. What should you configure?
Options
- Aa hunting livestream session
- Ba query bookmark
- Ca scheduled query rule
- Da Fusion rule
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C84% (21)
- D4% (1)
Why each option
To ensure an incident is automatically created in Microsoft Sentinel when a new attack vector identified by a custom hunting query is detected, a scheduled query rule must be configured.
A scheduled query rule in Microsoft Sentinel is designed to run a KQL query periodically, and if the query results meet defined criteria, it can generate security alerts and automatically create incidents. This directly fulfills the requirement of creating an incident when the new attack vector is detected through the custom hunting query.
A Fusion rule is a built-in Sentinel rule type that uses AI to correlate multiple low-fidelity alerts into a high-fidelity incident; however, it is not used to define custom detection logic for a new attack vector from scratch.
Concept tested: Microsoft Sentinel incident automation from custom queries
Source: https://learn.microsoft.com/en-us/azure/sentinel/create-custom-analytics-rules
Community Discussion
No community discussion yet for this question.