An organization is building a Microsoft Sentinel analytics rule to detect potential training data exfiltration from an Azure Machine Learning workspace. The analyst wants to alert when a data scientist downloads more than 1 GB of data from the training data storage account in a single day. Which KQL approach correctly implements this volume-based detection?
Select an answer to reveal the explanation.
Short Explanation
You need to query StorageBlobLogs because it records blob read/download operations and includes ResponseBodySize in bytes. Summarize by CallerIpAddress, bin the time to one day, and alert when the daily sum exceeds 1073741824 bytes.
Full Explanation
The correct approach is the StorageBlobLogs query that filters read operations, summarizes by CallerIpAddress and bin(TimeGenerated, 1d), and filters where the sum of ResponseBodySize exceeds 1073741824 bytes. StorageBlobLogs captures data plane operations on Azure Blob Storage, including read/download operations, and ResponseBodySize indicates the bytes downloaded per operation. Summarizing by caller identity and using bin(TimeGenerated, 1d) aggregates daily activity, then filtering the summed ResponseBodySize above 1073741824 bytes detects high-volume downloads.
The AzureActivity approach is incorrect because AzureActivity captures control plane operations and does not include data plane download operations with byte-level granularity for storage. The SecurityEvent approach is incorrect because SecurityEvent contains Windows Security Event Log data from servers; Azure Storage blob operations are captured in StorageBlobLogs, not SecurityEvent. The AzureDiagnostics for Azure ML dataset read operations approach is incorrect because AzureDiagnostics for Azure ML captures ML service-level events, not individual storage read operations with byte counts.