Security Analytics & Automation Flashcards

A SOC team wants to track mean time to respond (MTTR) across all incidents in Microsoft Sentinel. Which built-in feature provides this metric without writing custom KQL?

Answer: Microsoft Sentinel workspace analytics workbook (SOC Efficiency workbook)

The SOC Efficiency workbook in Microsoft Sentinel includes pre-built MTTR, MTTA, and incident closure metrics.

Which Microsoft Sentinel feature uses machine learning to correlate low-fidelity alerts from multiple products into high-fidelity incidents without requiring custom rules?

Answer: Fusion detection

Fusion uses ML to correlate signals across multiple Microsoft and third-party products, producing high-confidence incidents from low-signal alerts.

In a Microsoft Sentinel playbook, an analyst needs to parse a JSON field returned from an HTTP action before using its values. Which Logic Apps action should they use?

Answer: Parse JSON

The 'Parse JSON' action deserializes a JSON string into a structured object whose fields can be referenced in subsequent steps.

When onboarding a new Syslog data source to Microsoft Sentinel using AMA, which resource must be created to define which facilities and severities are collected?

Answer: Data Collection Rule (DCR)

A Data Collection Rule (DCR) defines the Syslog facilities, severities, and destination workspace for the Azure Monitor Agent.

Which advanced hunting KQL query technique allows a Defender XDR analyst to parameterize a query and reuse it across multiple investigations?

Answer: Saved functions in the Sentinel function library

Microsoft Sentinel allows saving KQL as reusable functions in the workspace function library, which can be called by name in any query.

A Sentinel analytic rule generates too many false positives because it triggers on service accounts. Which approach best reduces noise without disabling the rule?

Answer: Add a watchlist of service accounts and use '!in' to exclude them in the query

Using a watchlist of known service accounts with '!in' exclusion filters suppresses false positives while keeping detection active for real user accounts.

Which Microsoft Sentinel notebook capability enables analysts to apply Python-based machine learning models directly against Log Analytics data?

Answer: Jupyter notebooks via Azure Machine Learning integration

Sentinel integrates with Azure Machine Learning to run Jupyter notebooks that can query Log Analytics and apply custom Python ML models.