An organization's SOC team wants to proactively hunt for signs that an AI model API key has been leaked and is being used from external IP addresses. Azure OpenAI diagnostic logs are in Sentinel. Which KQL hunting query approach identifies calls from IPs not seen in the previous 30 days?

B is correct because this hunting query uses KQL's 'let' statements to compute two sets: (1) IPs seen in the last 24 hours and (2) IPs seen in the 30 days before that. Using the 'except' or 'join kind=leftantisemi' operator identifies IPs in the recent set that are not in the historical baseline, surfacing new, potentially unauthorized callers. This is a classic threat hunting pattern for detecting anomalous new access sources. A is wrong because comparing against a static watchlist requires maintenance and does not automatically adapt to the organization's legitimate IP range over time—it would generate false positives as new legitimate IPs are added. C is wrong because SecurityAlert contains security alert records, not raw diagnostic logs with caller IP details that haven't yet been alerted on; this approach misses new attacks not yet detected by rules. D is wrong because AzureActivity captures management plane operations, not data plane inference calls with source IPs.