A security engineer is analyzing Microsoft Sentinel incidents related to AI workloads. The engineer notices that many incidents are false positives because the Azure OpenAI diagnostic logs show legitimate batch processing jobs that spike token usage. Which Microsoft Sentinel feature allows the engineer to tune detection rules to reduce false positives from known legitimate behavior?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because Microsoft Sentinel analytics rules can be configured to exclude known legitimate entities using watchlists. By creating a watchlist containing the service principal IDs or IP addresses of known batch processing jobs, and referencing this watchlist in the analytics rule KQL query (using _GetWatchlist()), the rule will not fire for known legitimate sources, reducing false positives at the detection level rather than after-the-fact.
Full explanation below image
Full Explanation
A is correct because Microsoft Sentinel analytics rules can be configured to exclude known legitimate entities using watchlists. By creating a watchlist containing the service principal IDs or IP addresses of known batch processing jobs, and referencing this watchlist in the analytics rule KQL query (using _GetWatchlist()), the rule will not fire for known legitimate sources, reducing false positives at the detection level rather than after-the-fact. B is incorrect because Automation Rules with auto-close conditions reduce alert noise after incident creation but do not prevent the false positive incidents from being created, which still consumes analyst time and clutters the incident queue. C is incorrect because UEBA baselines individual user/entity behavior but requires a learning period and may not be precise enough for distinguishing specific batch job patterns in AI workloads. D is incorrect because bulk incident closure is a reactive remediation for existing false positives, not a proactive false positive reduction mechanism.