Microsoft Sentinelワークスペースの名前はWorkspacesです。 組み込みの統合 ASIM パーサーから、ソース固有の組み込み Advanced Security Information Model (ASIM) パーサーを除外する必要があります。 Workspace1には何を作成すべきですか?
正解:D
To exclude a built-in, source-specific Advanced Security Information Model (ASIM) parser from a built-in unified ASIM parser, you should create an analytic rule in the Microsoft Sentinel workspace. An analytic r ule allows you to customize the behavior of the unified ASIM parser and exclude specific source-specific parsers from being used. Reference: https://docs.micros oft.com/en-us/azure/sentinel/analytics-create-analytic-rule