Question

Your SOC has ingested Azure firewall and network device logs into Microsoft Sentinel. Management wants an interactive, drill-down dashboard that visualizes allowed-versus-blocked traffic trends over time, lets analysts filter by source subnet using parameters, and can be shared across the workspace without generating alerts. Which Microsoft Sentinel capability should you use to meet these requirements?

Accepted Answer

Create a Sentinel workbook based on a template and add parameters and visualizations backed by KQL queries

Answer

Create a scheduled analytics rule with a KQL query and enable entity mapping for the source subnet

Answer

Configure a hunting query and pin the results to the Sentinel investigation graph

Answer

Deploy a Logic App playbook that periodically emails traffic summaries to management