Security Analytics & Automation Flashcards

An analyst writes a KQL query using 'make-series' in Microsoft Sentinel. What is the primary purpose of this operator?

Answer: Create a time-series array of values for anomaly detection

make-series generates a dynamic array of values over time intervals, enabling time-series analysis and ML-based anomaly detection.

Which permission is required for a managed identity used by a Logic Apps playbook to add comments to a Microsoft Sentinel incident?

Answer: Microsoft Sentinel Responder

Microsoft Sentinel Responder allows playbooks to update incidents, add comments, and change status without full contributor rights.

In Microsoft Defender XDR, what does 'go hunt' on an alert entity automatically do?

Answer: Launches a pre-populated advanced hunting query scoped to that entity

'Go hunt' pre-populates an advanced hunting query filtered to the selected entity, accelerating investigation.

A security engineer wants to suppress repeated alerts from the same source IP for 1 hour after the first alert fires. Which Microsoft Sentinel feature handles this?

Answer: Alert suppression (also called 'Stop running query after alert is generated')

Alert suppression in analytic rules prevents re-triggering the same rule for a configurable period after an alert is generated.

Which table in Microsoft Sentinel (via Microsoft Defender for Endpoint) records process creation events useful for detecting LOLBin abuse?

Answer: DeviceProcessEvents

DeviceProcessEvents contains endpoint process creation telemetry from MDE, making it ideal for detecting living-off-the-land binary abuse.

An automation rule in Microsoft Sentinel is configured to run a playbook but the playbook does not execute. What is the most likely cause?

Answer: The playbook is deployed in a different Azure subscription without proper permissions

Playbooks in different subscriptions require explicit permission grants so Sentinel can invoke them; missing permissions silently block execution.

Which KQL function is used to detect anomalies in a time series within Microsoft Sentinel, returning a spike or drop indicator?

Answer: series_decompose_anomalies()

series_decompose_anomalies() decomposes a time series into trend, seasonality, and residual, then flags statistical anomalies.