An organization uses Azure AI Content Safety and wants to receive real-time alerts in Microsoft Sentinel when Azure AI Content Safety detects and blocks high-severity hate content in their AI application. Azure AI Content Safety metrics and logs are sent to a Log Analytics workspace connected to Sentinel. Which Sentinel component generates these alerts?

A is correct because Azure AI Content Safety sends diagnostic logs to Log Analytics, including content moderation decision records that capture the content category, severity level, and action taken (blocked/allowed) for each request. A Sentinel scheduled analytics rule can query these logs to detect high-severity hate content blocks in real time, creating incidents for analyst review. The rule can filter for category='Hate', severity='High', and action='Blocked' to focus on the most critical content safety events. B is wrong because Fusion rules correlate specific Microsoft security alert types using ML; they cannot be configured to correlate AI Content Safety logs with Entra ID events in a meaningful way for this use case. C is wrong because Defender for Cloud alerts cover AI resource security threats (like jailbreak attempts), not content policy enforcement events from Azure AI Content Safety moderation—those are operational content moderation logs. D is wrong because Azure Monitor Metric alerts based on counts or averages do not include the content category details (hate, high-severity) needed to generate meaningful security incidents; diagnostic log-based analytics rules provide the required granularity.