A company's Microsoft Sentinel workspace ingests Azure OpenAI diagnostic logs. The security team wants a scheduled analytics rule that fires when the same prompt is submitted more than 20 times in 1 hour from different user sessions, which could indicate automated probing. Which Microsoft Sentinel feature should be used to detect near-duplicate prompts?
Select an answer to reveal the explanation.
Short Explanation
You want a custom analytics rule using KQL with string hashing and aggregation because it lets you fingerprint prompt text, group by the fingerprint, and count matching prompts across user sessions in a one-hour window. That's the direct way to catch repeated automated probing.
Full Explanation
A custom analytics rule using KQL with string hashing and aggregation is correct because detecting near-duplicate prompts requires text similarity analysis in KQL. Engineers can implement approximate similarity using hash functions to fingerprint prompt content, then aggregate by hash to count occurrences across sessions. Custom analytics rules with this logic can detect automated probing patterns. Microsoft Sentinel Machine Learning behavior analytics with UEBA is incorrect because UEBA behavioral analytics focuses on user behavior anomalies such as volume and timing, not text content similarity across sessions. Microsoft Sentinel Fusion rule correlating multiple low-severity alerts is incorrect because Fusion rules correlate predefined low-fidelity alert types from multiple sources and are not designed for text similarity analysis. Microsoft Sentinel anomaly detection rule type with dynamic thresholds is incorrect because anomaly detection rules identify statistical deviations in numeric metrics but do not perform text content comparison.