An organization deploys Microsoft Sentinel to detect threats against their AI platform. The security team wants to create a detection for when an Azure OpenAI fine-tuned model is modified or deleted without proper change management. Which Microsoft Sentinel data source captures these events?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — b is correct because modifications and deletions to Azure OpenAI fine-tuned models are Azure control plane operations (resource management actions) captured in the AzureActivity table in Log Analytics. These operations (such as Microsoft.CognitiveServices/accounts/deployments/write or delete) are recorded as activity log entries when fine-tuned model deployments are created, modified, or deleted.
Full Explanation
B is correct because modifications and deletions to Azure OpenAI fine-tuned models are Azure control plane operations (resource management actions) captured in the AzureActivity table in Log Analytics. These operations (such as Microsoft.CognitiveServices/accounts/deployments/write or delete) are recorded as activity log entries when fine-tuned model deployments are created, modified, or deleted. A is incorrect because AzureDiagnostics with OpenAI fine-tuning logs captures training job data (loss metrics, training progress), not control plane changes to model deployments. C is incorrect because SecurityEvent contains Windows Security Event Log data from servers and is not related to Azure OpenAI service operations. D is incorrect because Entra ID AuditLogs capture identity and directory operations (user creation, group changes, app registration changes), not Azure resource operations like Azure OpenAI model modifications.