Question

Your SOC ingests very high volumes of firewall traffic logs into a Microsoft Sentinel workspace. You created a summary rule that aggregates connection counts per source IP into a dedicated summary rules table on a schedule. A threat hunter now wants to run fast KQL hunting queries to spot source IPs with abnormal connection spikes over the past 30 days, without querying the raw high-volume table each time. Which approach lets the hunter query the pre-aggregated results most efficiently?

Accepted Answer

Query the summary rule's destination custom table directly in Advanced Hunting/Logs, since it stores the aggregated results produced on each run

Answer

Re-run the original raw firewall table query with a summarize operator every time the hunter needs results

Answer

Convert the summary rule into a scheduled analytics rule so the aggregated data appears as incidents to hunt from

Answer

Move the raw firewall table to the Basic logs tier so hunting queries run faster against it