A security team is building a Microsoft Sentinel analytics rule to detect when an AI application service principal authenticates from an unusual geographic location. The rule should correlate Entra ID sign-in logs with a watchlist of expected service principal locations. Which KQL approach is correct?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because Microsoft Sentinel supports the _GetWatchlist() KQL function to retrieve watchlist data and join it with log data in analytics rules. The correct approach is to join SigninLogs with the location watchlist and alert when the sign-in country is not present in the expected locations watchlist for that service principal.
Full explanation below image
Full Explanation
A is correct because Microsoft Sentinel supports the _GetWatchlist() KQL function to retrieve watchlist data and join it with log data in analytics rules. The correct approach is to join SigninLogs with the location watchlist and alert when the sign-in country is not present in the expected locations watchlist for that service principal. B is incorrect because the union operator combines tables additively, not for join-based correlation; the correct KQL for watchlist correlation uses join or where-not-in with _GetWatchlist(). C is incorrect because Sentinel Workbooks are visualization tools and cannot generate security alerts. D is incorrect because Entra ID Identity Protection named locations are for user sign-in policies, not service principal location anomaly detection with custom watchlists.