An organization deploys Microsoft Sentinel to detect threats against their AI platform. The security team wants to create a detection for when an Azure OpenAI fine-tuned model is modified or deleted without proper change management. Which Microsoft Sentinel data source captures these events?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because modifications and deletions to Azure OpenAI fine-tuned models are Azure control plane operations (resource management actions) captured in the AzureActivity table in Log Analytics. These operations (such as Microsoft.CognitiveServices/accounts/deployments/write or delete) are recorded as activity log entries when fine-tuned model deployments are created, modified, or deleted.
Full explanation below image
Full Explanation
B is correct because modifications and deletions to Azure OpenAI fine-tuned models are Azure control plane operations (resource management actions) captured in the AzureActivity table in Log Analytics. These operations (such as Microsoft.CognitiveServices/accounts/deployments/write or delete) are recorded as activity log entries when fine-tuned model deployments are created, modified, or deleted. A is incorrect because AzureDiagnostics with OpenAI fine-tuning logs captures training job data (loss metrics, training progress), not control plane changes to model deployments. C is incorrect because SecurityEvent contains Windows Security Event Log data from servers and is not related to Azure OpenAI service operations. D is incorrect because Entra ID AuditLogs capture identity and directory operations (user creation, group changes, app registration changes), not Azure resource operations like Azure OpenAI model modifications.