A security operations analyst is using Microsoft Sentinel to detect anomalous usage of Azure OpenAI Service. The analyst wants to create an analytics rule that alerts when the number of Azure OpenAI API calls from a single IP address exceeds 10,000 within one hour. Which Sentinel analytics rule type is most appropriate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because a Scheduled analytics rule in Sentinel runs a KQL query on a defined schedule (e.g., every hour) against ingested logs (Azure OpenAI diagnostic logs) and fires an alert when the query results meet a defined threshold (>10,000 calls per IP per hour). This is the standard approach for threshold-based volume detection.
Full explanation below image
Full Explanation
C is correct because a Scheduled analytics rule in Sentinel runs a KQL query on a defined schedule (e.g., every hour) against ingested logs (Azure OpenAI diagnostic logs) and fires an alert when the query results meet a defined threshold (>10,000 calls per IP per hour). This is the standard approach for threshold-based volume detection. A is wrong because Fusion rules correlate signals from multiple data sources to detect multi-stage attacks; they cannot be configured with custom thresholds for a single data source pattern. B is wrong because ML behavior analytics rules use machine learning to detect anomalies across users and hosts (UEBA); they do not support custom threshold logic. D is wrong because NRT rules provide low-latency alerting (near real-time) but are still KQL-based and appropriate when sub-minute detection is required; the question asks for a one-hour window, so a Scheduled rule is more appropriate.