A security engineer is configuring Microsoft Sentinel to detect when Azure OpenAI API usage occurs outside of approved business hours (8 AM to 6 PM, Monday through Friday, UTC). The engineer writes a KQL query using AzureDiagnostics logs. Which KQL function correctly extracts the hour and day of week from TimeGenerated to filter business hours?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because KQL provides the hourofday() function that returns the hour component (0-23) of a datetime value, and the dayofweek() function that returns the day of week as a timespan (0 = Sunday through 6 = Saturday). These can be used in a where clause to filter for records where hourofday(TimeGenerated) < 8 or hourofday(TimeGenerated) >= 18 or dayofweek(TimeGenerated) in (0d, 6d) to detect outside-business-hours usage.
Full explanation below image
Full Explanation
A is correct because KQL provides the hourofday() function that returns the hour component (0-23) of a datetime value, and the dayofweek() function that returns the day of week as a timespan (0 = Sunday through 6 = Saturday). These can be used in a where clause to filter for records where hourofday(TimeGenerated) < 8 or hourofday(TimeGenerated) >= 18 or dayofweek(TimeGenerated) in (0d, 6d) to detect outside-business-hours usage. B is incorrect because while datetime_part() is a valid KQL function, 'dayOfWeek' is not the correct parameter name; 'dayOfWeek' requires checking KQL syntax ('DayOfWeek' or using dayofweek() directly). A is more straightforward. C is incorrect because format_datetime returns string representations and converting to integers requires additional parsing steps, making this approach unnecessarily complex compared to dedicated date/time functions. D is incorrect because bin() groups data by time bucket for aggregation purposes and using a lookup table adds complexity; direct functional filtering is more appropriate and efficient.