Labeling an IP address entity as an IoC directly from a Sentinel incident

SC-200 By islever Editorial Last updated

Ingest data into the Microsoft Sentinel SIEM and platform

Short answer

D Only IP address (along with domain, URL, file hash) is a supported entity type you can label as an IoC from the incident page.

Question

You have a Microsoft Sentinel workspace named SW1. In SW1, you investigate an incident that is associated with the following entities: • Host • IP address • User account • Malware name Which entity can be labeled as an indicator of compromise (IoC) directly from the incident's page?
  1. malware name
  2. host
  3. user account
  4. IP address Correct Answer

Key Takeaways

Sentinel's 'add entity to threat intelligence' supports IP addresses, domains, URLs, and file hashes, so among Host, IP address, User account, and Malware name, only the IP address qualifies for direct IoC labeling.

From a Sentinel incident's page, you can add an entity as a threat indicator (IoC) only for supported types—IP address (IPv4/IPv6), domain, URL, and file hash; of the listed entities, only the IP address can be labeled as an IoC directly.

Common mistake: Assuming a host, user account, or malware name can be added as an IoC — only IP, domain, URL, and file hash entities are supported for direct threat-indicator labeling.

Expert Analysis

Why the Answer Is Correct

In Microsoft Sentinel, you can add only specific entity types as threat indicators directly from an incident: domain name, IP address (IPv4 and IPv6), URL, and file (hash). Of the entities in the incident (Host, IP address, User account, Malware name), the IP address is the only one that matches a supported IoC type.

Why the Other Options Are Wrong

Host (B), User account (C), and Malware name (A) are not among the entity types that can be added as threat indicators from the incident page.

Community Comment Notes

The community is unanimous (D 100). Studytime2023 cites the add-entity-to-threat-intelligence documentation, and a_kto_to confirms only IP, domain, URL, and file hash can be added as indicators.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence

This link opens the official vendor documentation in a new tab.

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. Studytime2023 👍 2 Answered D
    Correct https://learn.microsoft.com/en-us/azure/sentinel/add-entity-to-threat-intelligence?tabs=incidents#add-an-entity-to-your-threat-intelligence
  2. a_kto_to 👍 1 Answered D
    "Add only the following types of entities as threat indicators: Domain name IP address (IPv4 and IPv6) URL File (hash) "
  3. f6ba8a1 👍 1
    I think Hash can be labeled as IoC
  4. sapphire 👍 1 Answered D
    Correct answer is IP
  5. 90158a0 👍 1 Answered D
    IP Address

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide