Threat Detection & Monitoring Flashcards

Which Microsoft Sentinel analytics rule type uses machine learning to detect anomalies without requiring a manually written KQL query?

Answer: Anomaly (UEBA)

Anomaly rules in Microsoft Sentinel use built-in ML models from UEBA to detect unusual behavior without requiring custom KQL.

In Microsoft Defender XDR, which table in Advanced Hunting contains information about email attachments that were found to contain malware?

Answer: EmailAttachmentInfo

The EmailAttachmentInfo table stores details about files attached to emails, including verdicts from threat analysis like malware detection.

A company's security team wants to receive a Teams notification whenever a Critical incident is created in Microsoft Sentinel. What is the MOST efficient way to implement this?

Answer: Configure an automation rule that triggers a playbook with a Teams connector

An automation rule in Sentinel can trigger a Logic App (playbook) when an incident is created, and the playbook can use the Teams connector to post a message.

Which Microsoft Defender for Cloud plan provides just-in-time (JIT) VM access to reduce the attack surface of management ports?

Answer: Defender for Servers

Defender for Servers includes JIT VM access, which blocks inbound traffic to management ports like RDP/SSH and opens them only on approved request.

An analyst queries the DeviceProcessEvents table in Advanced Hunting and wants to find all instances where cmd.exe was spawned by a Microsoft Office application. Which KQL filter is MOST appropriate?

Answer: where FileName == 'cmd.exe' and InitiatingProcessFileName in ('winword.exe','excel.exe','powerpnt.exe')

Using 'in' with specific Office process names (winword.exe, excel.exe, powerpnt.exe) precisely targets Office-spawned cmd.exe instances.

What is the purpose of the 'Entity behavior analytics' (UEBA) feature in Microsoft Sentinel?

Answer: To establish baselines and detect anomalous behavior per user and entity

UEBA builds behavioral baselines per user, device, and application, then assigns risk scores when observed behavior deviates from those baselines.

A Sentinel analytics rule is generating too many false positives. Which built-in mechanism allows an analyst to suppress repeated alerts for the same entity for a set time period?

Answer: Alert suppression (query scheduling cooldown)

The 'Stop running query after alert is generated' and suppression settings in a Scheduled analytics rule prevent duplicate alerts for the same scenario within a specified window.