Workspace1 という名前の Microsoft Sentinel ワークスペースがあります。 組み込みのソース固有の Advanced Security Information Model (ASIM) 解析を、組み込みの統合 ASIM パーサーから除外する必要があります。 Workspace1 には何を作成する必要がありますか?
正解:A
In Microsoft Sentinel, ASIM (Advanced Security Information Model) parsers standardize data ingestion across different log sources. If you need to exclude a specific built-in, source-specific ASIM parser (for instance, to prevent it from being invoked by a unified parser), Microsoft documentation specifies creating a watchlist named _ASIM_Exclusions in your workspace. The watchlist allows defining rules for exclusion by source or parser type-without modifying core ASIM logic-thus maintaining manageability and upgrade compatibility. # Correct answer: A. a watch list