A security team is building a Microsoft Sentinel analytics rule to detect when an AI application service principal authenticates from an unusual geographic location. The rule should correlate Entra ID sign-in logs with a watchlist of expected service principal locations. Which KQL approach is correct?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you join SigninLogs with the expected-location watchlist using _GetWatchlist(), then alert when LocationDetails.countryOrRegion isn't in that watchlist. That's how you correlate Entra ID sign-ins with custom expected locations in a Sentinel analytics rule.
Full Explanation
The correct approach is to join SigninLogs with the expected-location watchlist using _GetWatchlist() and filter where LocationDetails.countryOrRegion is not in the watchlist. Microsoft Sentinel supports _GetWatchlist() to retrieve watchlist data and join it with log data in analytics rules, alerting when the sign-in country is absent from the expected locations for that service principal. The union-operator approach is wrong because union combines tables additively, not for join-based correlation; watchlist correlation uses join or where-not-in with _GetWatchlist(). The Sentinel Workbook approach is wrong because Workbooks are visualization tools and cannot generate security alerts. The Entra ID Identity Protection named-locations approach is wrong because named locations are for user sign-in policies, not service principal location anomaly detection with custom watchlists.