Microsoft Sentinelの要件を満たすために、ハンティングクエリを実行できることを確認する必要があります。どのようなタイプのワークスペースを作成すればよいでしょうか?
正解:D
Microsoft Sentinel is built on top of Azure Monitor Log Analytics . All Sentinel data - including security alerts, incidents, and telemetry from connected sources - is stored and queried through a Log Analytics workspace . Sentinel's hunting feature uses Kusto Query Language (KQL) , which runs directly against the Log Analytics workspace data.
Official Sentinel documentation specifies:
"Microsoft Sentinel uses an Azure Monitor Log Analytics workspace as its foundation. All data collected by Sentinel is stored in that workspace, and hunting queries run on this data." Other workspace types such as Azure Synapse , Azure Databricks , or Azure Machine Learning are for analytics, data science, and modeling - not security log collection or KQL-based hunting.
# Therefore, to run hunting queries in Microsoft Sentinel, you must create a Log Analytics workspace.