A security engineer is configuring Microsoft Sentinel to detect when Azure OpenAI API usage occurs outside of approved business hours (8 AM to 6 PM, Monday through Friday, UTC). The engineer writes a KQL query using AzureDiagnostics logs. Which KQL function correctly extracts the hour and day of week from TimeGenerated to filter business hours?

The correct approach is to use hourofday(TimeGenerated) and dayofweek(TimeGenerated) to create the filter conditions. KQL provides the hourofday() function, which returns the hour component from 0 to 23 of a datetime value, and the dayofweek() function, which returns the day of week as a timespan where 0 is Sunday through 6 is Saturday. These can be used in a where clause to filter for records where hourofday(TimeGenerated) < 8 or hourofday(TimeGenerated) >= 18 or dayofweek(TimeGenerated) in (0d, 6d) to detect outside-business-hours usage. The datetime_part('hour', TimeGenerated) and datetime_part('dayOfWeek', TimeGenerated) approach is incorrect because, while datetime_part() is a valid KQL function, 'dayOfWeek' is not the correct parameter name; 'dayOfWeek' requires checking KQL syntax, such as 'DayOfWeek' or using dayofweek() directly, and the dedicated functions are more straightforward. The format_datetime(TimeGenerated, 'HH') and format_datetime(TimeGenerated, 'ddd') converted to integers approach is incorrect because format_datetime returns string representations, and converting them to integers requires additional parsing steps, making this approach unnecessarily complex compared to dedicated date/time functions. The bin(TimeGenerated, 1h) approach that groups by hour and filters using a business hours lookup table is incorrect because bin() groups data by time bucket for aggregation purposes, and using a lookup table adds complexity; direct functional filtering is more appropriate and efficient.