Question

Your SOC needs to detect a specific high-severity event—the disabling of a critical Azure AD Conditional Access policy—with the lowest possible detection latency. You decide to create a Near-Real-Time (NRT) analytics rule in Microsoft Sentinel. During rule creation, you attempt to configure the query to join the AuditLogs table with the SigninLogs table across a 24-hour lookback to enrich the alert with recent sign-in context. The validation fails. Which characteristic of NRT rules explains this failure and represents the correct way to proceed?

Accepted Answer

NRT rules cannot use joins or reference more than one table and are limited to querying a single table; enrichment across tables must be handled by a scheduled rule or post-alert automation instead.

Answer

NRT rules require the tables to be in the Basic logs tier before a join can be evaluated; convert AuditLogs to Basic logs to enable the join.

Answer

NRT rules support joins only when the lookback is set to 5 minutes or less; reduce the lookback window to 5 minutes to allow the join to validate.

Answer

NRT rules require entity mapping to be configured before any join can be added; map the account entity first, then re-add the join.