A Microsoft Sentinel analytics rule for Azure OpenAI threats generates 500 false positive alerts per day for legitimate high-volume API usage from a known batch processing service. The security team wants to suppress these alerts without disabling the rule. Which Sentinel feature should be used?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — d is correct because both approaches are valid and used in practice. Option A (modifying the KQL query to exclude the known batch service IP) reduces alert volume at the detection level—the analytics rule simply does not fire for that IP, preventing alert creation entirely.
Full explanation below image
Full Explanation
D is correct because both approaches are valid and used in practice. Option A (modifying the KQL query to exclude the known batch service IP) reduces alert volume at the detection level—the analytics rule simply does not fire for that IP, preventing alert creation entirely. Option B (creating an automation rule to auto-close incidents from this source) provides operational noise reduction after alerts are created—incidents are automatically triaged and closed. Both are legitimate SOC practices, and which one is used depends on organizational preference; the KQL exclusion (A) is more efficient since it prevents alert creation, while the automation rule (B) handles suppression at the incident level and provides an audit trail. C is wrong because Sentinel analytics rules do not have a built-in entity exclusion list feature—exclusions are implemented through KQL logic.