A Microsoft Sentinel analytics rule needs to be created to detect when an Azure OpenAI API key stored in Azure Key Vault is accessed by a service principal that is not in a pre-approved list. The analyst has a Sentinel watchlist named 'ApprovedAIServicePrincipals' with the approved ObjectIds. Which KQL approach correctly implements this detection?
Select an answer to reveal the explanation.
Short Explanation
You need to query AzureDiagnostics for Key Vault SecretGet operations, pull the caller's ObjectId, and use _GetWatchlist('ApprovedAIServicePrincipals') to alert when the caller isn't in the approved list. That's how you catch unauthorized service principals accessing the secret in near real-time.
Full Explanation
The correct approach is to query AzureDiagnostics for Azure Key Vault 'SecretGet' operations (data plane access events), extract the caller's identity (ObjectId or ClientId from the requestUri or identity fields), use the KQL _GetWatchlist('ApprovedAIServicePrincipals') function to load the approved list, and use a left anti-semi join or 'where not in' logic to find callers not in the approved list. This surfaces unauthorized secret accesses in near real-time. The Fusion-rule approach is wrong because Fusion rules correlate specific alert types from Microsoft security products using ML; they cannot be configured with custom watchlist-based authorization logic. The SecurityAlert approach is wrong because SecurityAlert captures generated security alerts; querying it for Key Vault anomaly alerts detects only what Defender for Key Vault has already flagged, missing unauthorized accesses from unknown service principals not yet flagged. The Azure Monitor Metric alerts approach is wrong because Azure Monitor Metric alerts on Key Vault request counts detect volume anomalies, not specific unauthorized caller identities.