An organization's Microsoft Sentinel deployment needs to detect when an Azure OpenAI model is being queried with system prompt override attempts (jailbreak patterns) in near real-time (latency under 1 minute). Which Sentinel analytics rule type provides the lowest detection latency?

B is correct because Microsoft Sentinel Near Real-Time (NRT) analytics rules are designed for low-latency detection, providing alerts within approximately 1 minute of the log data being ingested. For detecting jailbreak attempts in Azure OpenAI logs (which appear in Log Analytics with a short ingestion lag), NRT rules provide the fastest detection path compared to scheduled rules. A is wrong because a scheduled analytics rule with a 5-minute run frequency will detect the event only on the next scheduled run—up to 5 minutes after the jailbreak attempt, plus log ingestion time. The question requires sub-1-minute latency. C is wrong because Fusion rules use machine learning to correlate signals across multiple detections; they are not optimized for low-latency single-event detection. D is wrong because ML behavior analytics rules detect behavioral anomalies over longer time windows; they are not appropriate for near-real-time individual event detection.