What should you do?

You have an Azure subscription that uses Microsoft Sentinel.

You detect a new threat by using a hunting query.

You need to ensure that Microsoft Sentinel automatically detects the threat. The solution must minimize administrative effort.

What should you do?
A . Create a playbook.
B. Create a watchlist.
C. Create an analytics rule.
D. Add the query to a workbook.

View Answer

Answer: C

Explanation:

By creating an analytics rule, you can set up a query that will automatically run and alert you when the threat is detected, without having to manually run the query. This will help minimize administrative effort, as you can set up the rule once and it will run on a schedule, alerting you when the threat is detected.

Reference: https://docs.microsoft.com/en-us/azure/sentinel/analytics-create-rule