SC-200 · Question #389
You have a Microsoft 365 E5 subscription. You have the following KQL query. You need to use the query to create a Microsoft Defender XDR custom detection rule that can isolate an onboarded device…
The correct answer is D. Add the DeviceId and Timestamp columns to the project operator. The DeviceProcessEvents table in the advanced hunting schema contains information about process creation and related events. We would need the DeviceID and the Timestamp. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceprocessevents-table
Question
You have a Microsoft 365 E5 subscription. You have the following KQL query. You need to use the query to create a Microsoft Defender XDR custom detection rule that can isolate an onboarded device. How should you modify the query?
Options
- AAdd the AccountUpn and Timestamp columns to the project operator.
- BAdd a distinct operator.
- CAdd a summarize operator.
- DAdd the DeviceId and Timestamp columns to the project operator.
How the community answered
(41 responses)- A10% (4)
- B2% (1)
- C7% (3)
- D80% (33)
Explanation
The DeviceProcessEvents table in the advanced hunting schema contains information about process creation and related events. We would need the DeviceID and the Timestamp. https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-deviceprocessevents-table
Community Discussion
No community discussion yet for this question.