Threat Detection & Monitoring Flashcards

A SOC analyst notices repeated failed sign-in attempts followed by a successful login from an unusual country. Which Microsoft Sentinel analytics rule type is BEST suited to detect this pattern?

Answer: Scheduled

Scheduled analytics rules use KQL queries run on a defined schedule and are ideal for detecting multi-step patterns like brute-force followed by success.

Which Microsoft Defender XDR feature correlates alerts from multiple Defender products into a single, unified incident?

Answer: Automatic Attack Disruption

Automatic Attack Disruption uses AI to correlate signals across Defender products and contain active attacks by isolating affected assets.

You want to hunt for suspicious PowerShell executions across all endpoints in your organization. Which tool in Microsoft Defender XDR should you use?

Answer: Advanced Hunting

Advanced Hunting uses KQL to query up to 30 days of raw telemetry across endpoints, email, identity, and cloud apps.

An analyst wants Microsoft Sentinel to automatically assign a severity of High to any incident involving a watchlist match. Which feature enables this?

Answer: Automation Rule

Automation rules in Microsoft Sentinel can modify incident properties such as severity, owner, and status based on trigger conditions.

Which Microsoft Sentinel data connector uses the Common Event Format (CEF) over Syslog to ingest logs from third-party security appliances?

Answer: CEF via AMA

The CEF via Azure Monitor Agent connector forwards CEF-formatted syslog messages from Linux forwarders directly into Microsoft Sentinel.

A threat actor is using living-off-the-land binaries (LOLBins) to evade detection. Which Microsoft Defender for Endpoint capability is specifically designed to block this behavior?

Answer: Attack Surface Reduction (ASR) rules

Attack Surface Reduction rules include specific rules to block abuse of LOLBins like mshta.exe, wscript.exe, and others.

In Microsoft Sentinel, which built-in workbook provides an overview of data ingestion health, including volume trends and connector status?

Answer: Data Collection Health

The Data Collection Health workbook in Sentinel monitors ingestion latency, connector status, and data volume to ensure telemetry is flowing correctly.