Adding a query to a Sentinel workbook to build a timechart of SecurityEvent counts by day

Configure the Microsoft Sentinel SIEM and platform
Answer Correct answer: A — Adding a query against the SecurityEvent table computes and charts the daily event count as a timechart.

You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements: • Identify the number of security events ingested during the past week. • Display the count of events by day in a timechart. What should you add to Workbook1?

  1. a query Correct Answer
  2. a metric
  3. a group
  4. links or tabs
sentinel workbook query securityevent timechart workbook visualization

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

A workbook query against the SecurityEvent table is what retrieves and aggregates the data; rendering it as a timechart directly satisfies both the count-by-day and trend-visualization requirements.

To show the count of SecurityEvent rows ingested over the past week as a daily timechart in a Sentinel workbook, add a query that filters by time, aggregates the count by day, and renders a timechart.

Adding a metric, group, or links/tabs instead of a query — those do not execute a KQL query against the SecurityEvent table needed to compute and chart the event counts.

Community Discussion (3 comments)

ServerBrain 👍 10 Selected: A
A query allows you to retrieve specific data from the SecurityEvent table. You can write a query that filters events based on the past week’s timestamp and aggregates the count of events by day. The timechart visualization will display this aggregated data over time, showing the event count trends.
smanzana 👍 1
A is correct
RedZtopics 👍 1
query seems to be correct

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Sentinel workbooks are built from queries against Log Analytics tables. To count SecurityEvent rows over the past week and display them as a daily timechart, you add a query that filters on the time range, summarizes the count by day (bin), and renders a timechart.

Why the Other Options Are Wrong

A metric (B) is a pre-aggregated data source, not a flexible query for this calculation. A group (C) organizes steps but does not produce the data. Links or tabs (D) provide navigation, not the visualization.

Community Comment Notes

The community is unanimous (A 100). ServerBrain explains that a query can filter on the past week's timestamp and aggregate the count by day, with the timechart rendering the trend.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

Related Analysis

You have a Microsoft Sentinel workspace named SW1. You need

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

Your on-premises network contains an Active Directory Domain

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide