A Microsoft Sentinel investigation reveals that an attacker used a compromised service principal to call the Azure OpenAI management API and enumerate all model deployments, then used that information to target specific gpt-4 deployments for abuse. The analyst wants to investigate the full attack chain using Sentinel's investigation graph. Which Sentinel feature provides this visual attack chain analysis?

B is correct because Microsoft Sentinel's Incident Investigation graph is a purpose-built visual tool that displays the entities involved in an incident (accounts, IPs, Azure resources, service principals), the alerts connected to those entities, and the relationships between them. For this attack chain, the investigation graph would show the compromised service principal entity linked to the management API enumeration alert, the targeted Azure OpenAI deployment entities, and the subsequent abuse alerts—providing a visual attack timeline and relationship map. A is wrong because Sentinel Workbooks are configurable reporting tools for dashboards and visualizations; they do not provide the entity-relationship investigation graph tied to a specific incident. C is wrong because Defender XDR's Attack Story visualizes endpoint and identity attack chains within the Defender XDR portal; while Azure activity may appear, the primary investigation of Azure OpenAI management API abuse is best conducted in Sentinel where the Azure Activity logs are ingested. D is wrong because Security Exposure Management attack paths show posture-based attack paths across the environment, not the forensic reconstruction of a specific incident's event chain.