What should you create in Workspace1?

You have a Microsoft Sentinel workspace named Workspaces

You need to exclude a built-in. source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser.

What should you create in Workspace1?
A . a workbook
B. a hunting query
C. a watchlist
D. an analytic rule

View Answer

Answer: D

Explanation:

To exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser, you should create an analytic rule in the Microsoft Sentinel workspace. An analytic rule allows you to customize the behavior of the unified ASIM parser and exclude specific source-specific parsers from being used.

Reference: https://docs.microsoft.com/en-us/azure/sentinel/analytics-create-analytic-rule