An organization deploys Microsoft Sentinel to detect threats against their AI platform. The security team wants to create a detection for when an Azure OpenAI fine-tuned model is modified or deleted without proper change management. Which Microsoft Sentinel data source captures these events?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — modifications and deletions to Azure OpenAI fine-tuned models are control-plane resource operations, so you'll find them in the AzureActivity table filtered for Azure OpenAI fine-tuning resource operations. That's where Azure records create, modify, and delete actions against the resource.
Full Explanation
The correct answer is the AzureActivity table filtering for Azure OpenAI fine-tuning resource operations because modifications and deletions to Azure OpenAI fine-tuned models are Azure control plane operations, also called resource management actions, captured in the AzureActivity table in Log Analytics. These operations, such as Microsoft.CognitiveServices/accounts/deployments/write or delete, are recorded as activity log entries when fine-tuned model deployments are created, modified, or deleted. The AzureDiagnostics table with Category = 'OpenAIFinetuningLogs' is incorrect because it captures training job data, such as loss metrics and training progress, not control plane changes to model deployments. The SecurityEvent table with Windows Event IDs related to Azure OpenAI changes is incorrect because SecurityEvent contains Windows Security Event Log data from servers and is not related to Azure OpenAI service operations. The AuditLogs table from Microsoft Entra ID for Azure OpenAI service principal operations is incorrect because Entra ID AuditLogs capture identity and directory operations, such as user creation, group changes, and app registration changes, not Azure resource operations like Azure OpenAI model modifications.