An organization's Microsoft Sentinel deployment needs to detect when an Azure OpenAI model is being queried with system prompt override attempts (jailbreak patterns) in near real-time (latency under 1 minute). Which Sentinel analytics rule type provides the lowest detection latency?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want the Near Real-Time analytics rule because it fires alerts within about a minute after logs land in Sentinel. For jailbreak prompt attempts in Azure OpenAI logs, that's the fastest detection path you've got.
Full Explanation
The Near Real-Time analytics rule is correct because Microsoft Sentinel Near Real-Time analytics rules are designed for low-latency detection, providing alerts within approximately 1 minute of the log data being ingested. For detecting jailbreak attempts in Azure OpenAI logs, which appear in Log Analytics with a short ingestion lag, Near Real-Time analytics rules provide the fastest detection path compared with scheduled rules. The scheduled analytics rule with a 5-minute run frequency is wrong because it detects the event only on the next scheduled run—up to 5 minutes after the jailbreak attempt, plus log ingestion time; the question requires sub-1-minute latency. The Fusion analytics rule is wrong because Fusion rules use machine learning to correlate signals across multiple detections; they are not optimized for low-latency single-event detection. The ML behavior analytics rule is wrong because ML behavior analytics rules detect behavioral anomalies over longer time windows; they are not appropriate for near-real-time individual event detection.