In Microsoft Sentinel, to receive near real-time alerts when specific activities occur-such as Azure Storage account key enumeration -you combine two Sentinel capabilities: Livestream and Analytics rules .
* Livestream provides real-time monitoring of events based on KQL q ueries. According to Microsoft Sentinel documentation, Livestream "lets you run queries continuously and get notified immediately when results match specific conditions." This allows SOC analysts to detect ongoing attacks (such as credential enumeration) a s they happen.
* Analytics rules provide ongoing automated monitoring and alerting. A scheduled analytics rule runs periodically (for example, every 5 minutes) and gen erates an alert when a defined condition is met.
The "Storage account keys enumerated" even t comes from Microsoft Defender for Cloud (or Azure Activity) logs, so you can define a KQL-based rule to detect these activities.
Therefore:
* B (Analytics rule): to automatically generate alerts when the condition is met.
* C (Livestream): to receive those a lerts or detections in near real-time as they occur.
Together, these meet the requirement for near real-time detection and alerting with minimal manual monitoring.