A security engineer needs to configure Microsoft Sentinel to ingest Azure OpenAI Service diagnostic logs for threat detection. What are the two required steps to enable this data flow?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because there is no dedicated 'Azure OpenAI' data connector in Sentinel that one-click enables log collection. Instead, you must configure Azure OpenAI's diagnostic settings to route logs (including audit logs and RequestResponse logs) to a Log Analytics workspace.
Full explanation below image
Full Explanation
B is correct because there is no dedicated 'Azure OpenAI' data connector in Sentinel that one-click enables log collection. Instead, you must configure Azure OpenAI's diagnostic settings to route logs (including audit logs and RequestResponse logs) to a Log Analytics workspace. If that workspace is the same one connected to Sentinel (or connected via workspace data sources), Sentinel can then query those logs for analytics rules and hunting. The RequestResponse category specifically captures prompt and completion content for security analysis. A is wrong because there is no standalone 'Azure OpenAI data connector' in Sentinel that works with just a permission grant—the mechanism is diagnostic settings. C is wrong because while Sentinel content hub solutions for AI may exist with analytics rule templates, they still require the underlying diagnostic settings to be configured to collect logs. D is wrong because the Defender for AI Services connector sends security alerts from Defender, not the raw diagnostic logs including prompt content.