Adding a query to a Sentinel workbook to build a timechart of SecurityEvent counts by day

SC-200 By islever Editorial Last updated

Configure the Microsoft Sentinel SIEM and platform

Short answer

A Adding a query against the SecurityEvent table computes and charts the daily event count as a timechart.

Question

You have a Microsoft Sentinel workspace that contains a custom workbook named Workbook1. You need to create a visual based on the SecurityEvent table. The solution must meet the following requirements: • Identify the number of security events ingested during the past week. • Display the count of events by day in a timechart. What should you add to Workbook1?
  1. a query Correct Answer
  2. a metric
  3. a group
  4. links or tabs

Key Takeaways

A workbook query against the SecurityEvent table is what retrieves and aggregates the data; rendering it as a timechart directly satisfies both the count-by-day and trend-visualization requirements.

To show the count of SecurityEvent rows ingested over the past week as a daily timechart in a Sentinel workbook, add a query that filters by time, aggregates the count by day, and renders a timechart.

Common mistake: Adding a metric, group, or links/tabs instead of a query — those do not execute a KQL query against the SecurityEvent table needed to compute and chart the event counts.

Expert Analysis

Why the Answer Is Correct

Microsoft Sentinel workbooks are built from queries against Log Analytics tables. To count SecurityEvent rows over the past week and display them as a daily timechart, you add a query that filters on the time range, summarizes the count by day (bin), and renders a timechart.

Why the Other Options Are Wrong

A metric (B) is a pre-aggregated data source, not a flexible query for this calculation. A group (C) organizes steps but does not produce the data. Links or tabs (D) provide navigation, not the visualization.

Community Comment Notes

The community is unanimous (A 100). ServerBrain explains that a query can filter on the past week's timestamp and aggregate the count by day, with the timechart rendering the trend.

Official Reference

https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

This link opens the official vendor documentation in a new tab.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. ServerBrain 👍 10 Answered A
    A query allows you to retrieve specific data from the SecurityEvent table. You can write a query that filters events based on the past week’s timestamp and aggregates the count of events by day. The timechart visualization will display this aggregated data over time, showing the event count trends.
  2. RedZtopics 👍 1
    query seems to be correct
  3. smanzana 👍 1
    A is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide