A security engineer is building a Microsoft Sentinel hunting notebook to detect anomalous patterns in Azure OpenAI usage using machine learning-based time-series analysis. Which KQL function enables detecting statistical anomalies in the number of Azure OpenAI API calls per hour over the past 30 days?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because KQL's 'make_series()' function creates a time series from log data (e.g., API calls per hour over 30 days), and 'series_decompose_anomalies()' applies a statistical model to detect anomalies in the series—identifying data points that deviate significantly from the expected seasonal and trend patterns. This is more sophisticated than static thresholds because it adapts to the normal usage pattern (e.g., low calls on weekends, higher on business days).
Full explanation below image
Full Explanation
A is correct because KQL's 'make_series()' function creates a time series from log data (e.g., API calls per hour over 30 days), and 'series_decompose_anomalies()' applies a statistical model to detect anomalies in the series—identifying data points that deviate significantly from the expected seasonal and trend patterns. This is more sophisticated than static thresholds because it adapts to the normal usage pattern (e.g., low calls on weekends, higher on business days). B is wrong because a static threshold-based count comparison does not adapt to usage patterns and generates more false positives during legitimate peaks or misses anomalies during normally quiet periods. C is wrong because arg_max() finds the record with the maximum value in a group; it identifies the peak but does not perform anomaly detection relative to a historical pattern. D is wrong because percentile() calculates distribution percentiles for threshold setting; it is a static analysis measure, not a time-series anomaly detection function.