Finding enabled anomaly rules in Sentinel on the Analytics page Anomalies tab

SC-200 By islever Editorial Last updated

Configure detections

Short answer

C Enabled anomaly rules are listed in the Anomalies tab on the Sentinel Analytics page.

Question

You have a Microsoft Sentinel workspace named SW1. You need to identify which anomaly rules are enabled in SW1. What should you review in Microsoft Sentinel?
  1. Content hub
  2. Entity behavior
  3. Analytics Correct Answer
  4. Settings

Key Takeaways

Sentinel surfaces its built-in anomaly rules under the Analytics page's Anomalies tab rather than Content hub, Entity behavior, or Settings, making Analytics the place to review their status.

To see which anomaly detection rules are enabled in a Microsoft Sentinel workspace, review the Anomalies tab on the Analytics page, where anomaly rules are displayed in a grid showing their enabled state.

Common mistake: Looking in Entity behavior or Content hub — those manage UEBA configuration and solution content respectively, not the grid of enabled anomaly rules.

Expert Analysis

Why the Answer Is Correct

Microsoft Sentinel lists anomaly rules in a grid on the Anomalies tab within the Analytics page, where you can see which anomaly rules are enabled. This is the designated location for reviewing anomaly-rule status.

Why the Other Options Are Wrong

Content hub (A) is for deploying and managing solution content. Entity behavior (B) configures user and entity behavior analytics but does not list anomaly rules. Settings (D) holds workspace configuration, not the anomaly-rule grid.

Community Comment Notes

The community is unanimous (C 100). rsanx42 (9 likes) cites the work-with-anomaly-rules documentation, noting anomaly rules appear in the Anomalies tab of the Analytics page.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/work-with-anomaly-rules

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. rsanx42 👍 9 Answered C
    C: Analytics You can now find anomaly rules displayed in a grid in the Anomalies tab in the Analytics page. https://learn.microsoft.com/en-us/azure/sentinel/work-with-anomaly-rules
  2. a_kto_to 👍 1 Answered C
    ChatGTP: C. Analytics
  3. sapphire 👍 1 Answered C
    correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide