In Microsoft Sentinel, to detect and alert on a specific behavior (such as enumeration of Azure Storage account keys), two steps are needed:
* Add a data connector - This step ensures that the relevant Azure Activity or Azure Storage logs are ingested into Sentinel. Without connecting the appropriate data source, Sentinel cannot analyze or detect that event type.
* Create an analytics rule - Once the data is ingested, you define a rule that continuously runs a KQL query to detect specific activities (like key enumeration). The analytics rule evaluates the query on a schedule and triggers an immediate alert when conditions are met.
Microsoft's Sentinel operations documentation confirms:
"To generate alerts, data must first be collected from relevant sources via connectors. Analytics rules then process this data to detect threats and trigger alerts or incidents." Livestream, hunting queries, and bookmarks are used for investigation or manual hunting but do not trigger automated alerts.
Hence, the correct combination is:
# B. Add a data connector
# C. Create an analytics rule