A security analyst is threat hunting for potential model inversion attacks against an Azure OpenAI deployment. The analyst wants to find API calls where the request body contains an unusually large number of tokens compared to the average. Which Microsoft Sentinel query approach should be used?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to hunt in the AzureDiagnostics table, filter for Azure OpenAI resource type, and look for statistical outliers in prompt token counts. That's where per-call token usage lands, so you can spot unusually large requests that may signal model inversion or data extraction.
Full Explanation
The correct approach is to query the AzureDiagnostics table, filter for ResourceType == 'OPENAI', and calculate statistical outliers in prompt token counts. Azure OpenAI diagnostic logs land in AzureDiagnostics and include per-call token usage, so KQL can find unusually large requests that may signal model inversion or data extraction. Querying SecurityAlert for Defender for AI 'ModelInversion' alerts is wrong because that specific classification does not exist; this needs custom hunting. Querying CommonSecurityLog for Azure OpenAI CEF events with high RequestBody character counts is wrong because Azure OpenAI does not emit CEF logs there; it uses Azure Diagnostics. Querying AzureActivity for PUT operations with large request payloads is wrong because AzureActivity captures control plane operations, not data plane Azure OpenAI API calls.