Security Analytics & Automation Flashcards

Which Microsoft Sentinel feature allows analysts to visually investigate the relationships between entities such as accounts, IPs, and hosts involved in an incident?

Answer: Investigation graph

The Investigation graph in Microsoft Sentinel provides a visual map of entity relationships and timeline for an incident.

A Logic Apps playbook fails intermittently when querying Microsoft Sentinel. Which best practice reduces transient failures?

Answer: Add retry policies to the HTTP or connector actions

Configuring retry policies on connector actions handles transient API errors and improves playbook reliability.

An analyst uses 'externaldata' in a KQL query. What is the primary use case for this operator in Microsoft Sentinel hunting?

Answer: Import reference data from a URL (e.g., threat intel CSV) into a query

externaldata loads tabular data from an external URL like Azure Blob Storage into a KQL query for enrichment or lookups.

In Microsoft Sentinel, what is the purpose of the 'entity mapping' section in an analytic rule?

Answer: Maps query output fields to recognized entity types for incident enrichment

Entity mapping links query result columns to entity types (Account, IP, Host) so Sentinel can enrich incidents with entity context.

Which Microsoft Sentinel data connector type uses a Log Analytics agent (MMA/AMA) installed on the source machine?

Answer: Agent-based connector (Syslog/CEF)

Agent-based connectors (Syslog/CEF) require the Log Analytics or Azure Monitor agent installed on the log source.

A playbook needs to add a tag to a Microsoft Sentinel incident when a specific entity IP is found in a threat intelligence watchlist. Which Logic Apps trigger should initiate this playbook?

Answer: Microsoft Sentinel — When Microsoft Sentinel incident creation rule was triggered

The 'When Microsoft Sentinel incident creation rule was triggered' trigger fires when an automation rule invokes the playbook at incident creation.

When configuring User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel, which data source provides the baseline for anomaly scoring of Azure AD sign-in behavior?

Answer: Azure AD sign-in and audit logs

UEBA baselines Azure AD sign-in and audit logs to establish normal user behavior patterns and score deviations.