Exam SC-200 topic 3 question 7 discussion

Answer should be A, D. IP address data is removed from the query in the | summarize, and is not mapped to the IP custom entity.

Correct answer A, D.

Ask ChatGPT

A & D is correct

A and D as IP is removed

in exam 9/20/23

"user" should be replaced with Account

A. user and D. computer. To group alerts into incidents in Azure Sentinel, you can use any combination of the available grouping fields. In this case, since the rule query does not include information on resource groups or IP addresses, only user and computer can be used to group alerts into incidents. Grouping alerts by user and computer can help you identify patterns of activity and better understand the scope and impact of potential security threats. By grouping alerts into incidents, you can also more easily manage and track your response to security incidents.

To group alerts into incidents in Azure Sentinel, you can use the "user" and "computer" components in the rule query.

AD correct

A&D is Correct

Added the script to a analytic rule and get "Account" and "Host" as only options.

Thinking top AD also

A and D

IP is not returned in the query. We can see that the Account and Computer were mapped to entities and were returned in the 'summarize' section.

You can group by user and computer

Best answer