A Microsoft Sentinel analytics rule needs to detect when an Azure OpenAI model is being used to generate large volumes of similar requests in a short period, potentially indicating automated abuse. A security engineer writes a KQL query to detect this. Which KQL operator is most appropriate for identifying time-windowed frequency anomalies?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because the KQL 'summarize' operator combined with the 'bin()' function on TimeGenerated is the standard approach for time-series aggregation, counting requests per time bucket (e.g., per minute or per 5 minutes) from the same caller. This enables detection of high-frequency patterns that may indicate automated abuse.
Full explanation below image
Full Explanation
A is correct because the KQL 'summarize' operator combined with the 'bin()' function on TimeGenerated is the standard approach for time-series aggregation, counting requests per time bucket (e.g., per minute or per 5 minutes) from the same caller. This enables detection of high-frequency patterns that may indicate automated abuse. B is incorrect because a self-join on the Azure Diagnostics table would be computationally expensive and is not the standard approach for time-windowed frequency detection. C is incorrect because while 'extend' adds calculated fields, it alone cannot aggregate across multiple requests to compute frequency; summarize is required for aggregation. D is incorrect because 'mv-expand' is used to expand multi-value or dynamic array fields into individual rows, not for time-window frequency analysis.