To investigate which accounts generate the most alerts and correlate them with incident data, Microsoft Sentinel requires a solution package that provides identity-focused analytics and workbooks.
The Cloud Identity Threat Protection Essentials solution from the Microsoft Sentinel Content hub delivers:
* Prebuilt workbooks and analytics rules integrating Azure Activity, Entra ID logs, and Defender XDR alerts.
* Visualizations showing users with most alerts and related incidents.
* UEBA integration is optional, but installing this solution automatically provides identity-centric detection with minimal configuration.
UEBA (User and Entity Behavior Analytics), by itself, detects anomalies but does not provide built-in alert correlation dashboards. Therefore, to meet the requirement with minimal administrative effort, installing the prebuilt Sentinel content package is the correct step.
# Correct answer: B. From Content hub, install Cloud Identity Threat Protection Essentials