SC-200 — frequently asked questions

Advanced Hunting is for manual, ad-hoc investigation using KQL. Threat Analytics is for saving and automating those queries as 'trackers' to continuously monitor for threats.

Yes, you can run any KQL query in Advanced Hunting. However, only by saving it as a tracker in Threat Analytics does it become a persistent assessment tool for the subscription's status.

Because the stem says LA1 remediates security risks, and Defender for Cloud maps risks to recommendations; manually triggering from a recommendation validates that path.

Yes. With that workflow trigger configured, you can open a recommendation and select Trigger logic app to run LA1 manually for testing.

No. The Logic App holds the send-email action; the workflow automation only decides when to invoke it, based on the alert name and severity conditions you configure.

Only if the sample alert's name matches your workflow condition. Sample alerts use generic names, so a digital currency mining filter typically will not fire.

The supported preview workflow is not a standalone incident Timeline tab; it starts from the investigation graph, where you select an entity and open the Timeline card in the entity side panel.

The Defender portal can show the alert, but the requirement is to update the Microsoft Sentinel incident; that is done from the Sentinel entity timeline, not the Defender Alerts page.

Yes. The search job writes results to a table, so in the Run a search job pane you specify the new table name before starting the job.

Enabling Search job mode configures the query for long-running search-job behavior, while selecting Run a search job submits the configured job after the table name is entered.

The Hunting node is for running advanced hunting queries and bookmarks; it does not present the dedicated MITRE ATT&CK coverage matrix that Threat management provides.

Incidents group alerts for triage, but the dedicated MITRE ATT&CK node is the view that maps detections to tactics and techniques with minimal effort.

Auxiliary tables in Microsoft Sentinel only support single-table queries, so JOIN and similar cross-table operators fail until search jobs stage the data into Analytics tables.

Yes. The _SRCH tables are temporary search-job outputs; deleting them after the JOIN minimizes storage and retention costs, which the question requires.

Use union isfuzzy=true together with a datatable(isMissing:int)[1] seed row so the query never fails and always emits exactly one row with isMissing set to 0 or 1.

A plain union resolves every table reference up front, so if AzureActivity is absent in one workspace the whole query errors instead of reporting isMissing = 1.

Copilot Contributor authorizes Copilot use, but Sentinel data access is controlled by Sentinel workspace RBAC, so User1 still needs a Sentinel role.

It grants write and management actions, while the plugin scenario only needs read/query access; Microsoft Sentinel Reader is narrower.

30 days is the default but does not maximize interactive queries; Azure Activity data is free to retain for 90 days, so 90 days gives more query time at no extra retention cost.

It is deleted unless you extend retention or use long-term retention, which adds cost and is not needed to meet the minimize-cost requirement.

Device4 does not satisfy the platform or onboarding requirements for Defender for Endpoint custom indicators, so custom IoCs are not applied to it.

Yes. Custom indicators are enforced on devices that are onboarded to Defender for Endpoint and running a supported operating system.

It grants read access to Workspace1 data, but the question's issue is writing Job1 output into existing Table1, which requires matching Table1's schema.

No, the table already exists and the suffix is not a mechanism for aligning Job1's output columns and types.

AzureActivity records Azure control-plane operations and lacks ResponseStatusCode; MicrosoftGraphActivityLogs stores Graph API HTTP status codes, so it is the correct table.

This hotspot targets 401 Unauthorized, which Graph activity logs capture for requests rejected as unauthorized; 403 Forbidden represents a separate permissions condition.

No. Entra Conditional Access only hosts the Session control and a 'Configure custom policy' link; the session policy itself must be authored in the Microsoft Defender portal under Cloud apps > Policies.

The Session access controls. Enable 'Use Conditional Access App Control' there and pick Custom1 as the custom policy to apply to the session.

Sharing a URL is a passive action that doesn't notify the other administrator or update the incident's ownership status, which can lead to tracking issues.

Yes, you can select multiple incidents in the incident list view and use the 'Assign' action to delegate them to one or more administrators simultaneously.

WEF only ships security event logs; it does not sync Active Directory users, groups or other directory entities. UEBA needs identity entities, which come from the Defender for Identity connector.

Yes. The connector authenticates to your Defender for Identity instance and pulls its data, so the sensor must already be running on a domain controller and reporting identity data.

An Investigation Package is a compressed ZIP file containing forensic data collected by MDE during an automated investigation. It includes details like running processes, network connections, and registry changes to help analysts understand the threat context.

No. Sentinel Automation Rules manage incident states and notifications. To collect an investigation package via Sentinel, you would need to create a custom playbook (Logic App) that calls the MDE API, which adds significant administrative complexity.

It collects running processes, active network connections, installed programs, scheduled tasks, services, and relevant event logs from the endpoint.

Use Live Response when you need to perform specific, ad-hoc commands or interact with the system in real-time to investigate complex, non-standard scenarios.

Resolving an alert keeps it visible in the Alerts queue with a 'Resolved' status. The question requires hiding the alert, which removes it from the queue entirely.

Yes, modern Microsoft Defender for Endpoint allows suppression rules to be scoped to specific device groups, making it ideal for targeting specific teams like accounting.