Exam SC-200 topic 3 question 62 discussion

Actual exam question from Microsoft's SC-200

Question #: 62
Topic #: 3

HOTSPOT
-

You have a Microsoft Sentinel workspace named SW1.

You plan to create a custom workbook that will include a time chart.

You need to create a query that will identify the number of security alerts per day for each provider.

How should you complete the query? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by ACSC at Jan. 22, 2023, 1:54 p.m.

Comments

Submit Cancel

ACSC

Highly Voted 1 year, 4 months ago

Correct. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-workbooks-101-with-sample-workbook/ba-p/1409216

upvoted 20 times

...

chepeerick

Most Recent 7 months, 1 week ago

Correct Option

upvoted 2 times

...

donathon

9 months, 3 weeks ago

Time charts are similar to line graphs but lay out more information and focus more on a time frame of information. This ties into tracking anomalies, unhealthy trends, and more. This also ties into time brushing in the advanced section. Similar to regular graphs, the query option must be chosen. This time around, the query will need a ‘bin’ operator. The bin operator will take a variable and a time scale value and create a series based on the data. An example would be ‘summarize count() by ProviderName, bin(TimeGenerated, 1d)'. This is taking a count of ProviderName from the query results and generating a time series that will show the amount of results per day.

upvoted 4 times

...