Exam MS-500 topic 2 question 52 discussion

DRAG DROP -
You have an Azure Sentinel workspace that has an Office 365 connector.
You are threat hunting events that have suspicious traffic from specific IP addresses.
You need to save the events and the relevant query results for future reference.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

Suggested Answer:
Reference:
https://docs.microsoft.com/en-us/azure/sentinel/bookmarks