A Microsoft Sentinel analytics rule needs to be created to detect when an Azure OpenAI API key stored in Azure Key Vault is accessed by a service principal that is not in a pre-approved list. The analyst has a Sentinel watchlist named 'ApprovedAIServicePrincipals' with the approved ObjectIds. Which KQL approach correctly implements this detection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because this detection requires: (1) querying the AzureDiagnostics table for Azure Key Vault 'SecretGet' operations (data plane access events), extracting the caller's identity (ObjectId or ClientId from the requestUri or identity fields), (2) using the KQL _GetWatchlist('ApprovedAIServicePrincipals') function to load the approved list, and (3) using a left anti-semi join or 'where not in' logic to find callers not in the approved list. This surfaces unauthorized secret accesses in near real-time.
Full explanation below image
Full Explanation
A is correct because this detection requires: (1) querying the AzureDiagnostics table for Azure Key Vault 'SecretGet' operations (data plane access events), extracting the caller's identity (ObjectId or ClientId from the requestUri or identity fields), (2) using the KQL _GetWatchlist('ApprovedAIServicePrincipals') function to load the approved list, and (3) using a left anti-semi join or 'where not in' logic to find callers not in the approved list. This surfaces unauthorized secret accesses in near real-time. B is wrong because Fusion rules correlate specific alert types from Microsoft security products using ML; they cannot be configured with custom watchlist-based authorization logic. C is wrong because SecurityAlert captures generated security alerts; querying it for Key Vault anomaly alerts detects only what Defender for Key Vault has already flagged, missing unauthorized accesses from unknown service principals not yet flagged. D is wrong because Azure Monitor Metric alerts on Key Vault request counts detect volume anomalies, not specific unauthorized caller identities.