You have a Microsoft Sentinel workspace. You are investigating an incident that involves multiple alerts, events, and entities. You need to create a bookmark for the investigation. The solution must…

The correct answer is B. Hunting. In Microsoft Sentinel, bookmarks are created directly from within the Hunting section. When running a hunting query and reviewing results, analysts can select specific result rows and click 'Add bookmark' to save those records - preserving the query context, results, and notes…

Submitted by lukas.cz· Apr 18, 2026

Question

You have a Microsoft Sentinel workspace. You are investigating an incident that involves multiple alerts, events, and entities. You need to create a bookmark for the investigation. The solution must minimize administrative effort. Which settings should you use?

Options

AIncidents
BHunting
CContent hub
DLogs

How the community answered

(39 responses)

A
8% (3)
B
72% (28)
C
18% (7)
D
3% (1)

Explanation

In Microsoft Sentinel, bookmarks are created directly from within the Hunting section. When running a hunting query and reviewing results, analysts can select specific result rows and click 'Add bookmark' to save those records - preserving the query context, results, and notes for ongoing investigation. This workflow is built into the Hunting interface and requires no additional configuration, minimizing administrative effort. The Incidents page manages incidents but does not create bookmarks from raw query results. Content hub is for installing solutions and content packages. The Logs page supports ad hoc queries but does not have the native bookmark functionality integrated into the investigation workflow the way Hunting does.

Community Discussion

No community discussion yet for this question.

Full SC-200 Practice