A threat hunter is investigating potential data exfiltration from Azure OpenAI Service. Azure OpenAI diagnostic logs are ingested into Microsoft Sentinel. The hunter wants to find all instances where the token count in a single completion response exceeded 10,000 tokens in the last 24 hours. Which KQL query correctly retrieves this data?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because Azure OpenAI Service sends diagnostic logs to Log Analytics (Sentinel) as AzureDiagnostics events. The completion token count is captured in the 'completionTokens_d' field.
Full explanation below image
Full Explanation
A is correct because Azure OpenAI Service sends diagnostic logs to Log Analytics (Sentinel) as AzureDiagnostics events. The completion token count is captured in the 'completionTokens_d' field. Filtering for ResourceType 'OPENAI' and completionTokens_d > 10000 with a time filter of the last 24 hours correctly retrieves the large completion events that could indicate data exfiltration. B is wrong because SecurityEvent with EventID 4663 is a Windows object access audit event from Active Directory/Windows, not Azure OpenAI logs. C is wrong because AzureActivity captures control plane operations (resource creation, deletion) on Azure resources, not inference API call details. D is wrong because OfficeActivity captures Microsoft 365 activity including Copilot interactions, not Azure OpenAI Service API call metrics.