A company's Microsoft Sentinel workspace ingests Azure OpenAI diagnostic logs. The security team wants a scheduled analytics rule that fires when the same prompt is submitted more than 20 times in 1 hour from different user sessions, which could indicate automated probing. Which Microsoft Sentinel feature should be used to detect near-duplicate prompts?

B is correct because detecting near-duplicate prompts requires text similarity analysis in KQL. Engineers can implement approximate similarity using hash functions to fingerprint prompt content, then aggregate by hash to count occurrences across sessions. Custom analytics rules with this logic can detect automated probing patterns. A is incorrect because UEBA behavioral analytics focuses on user behavior anomalies such as volume and timing, not text content similarity across sessions. C is incorrect because Fusion rules correlate predefined low-fidelity alert types from multiple sources and are not designed for text similarity analysis. D is incorrect because anomaly detection rules identify statistical deviations in numeric metrics but do not perform text content comparison.