Azure Sentinel で脅威を検出するためのカスタム分析ルールがあります。 分析ルールの実行が停止したことがわかります。ルールは無効になっており、ルール名には AUTO DISABLED というプレフィックスが付いています。 問題の考えられる原因は何ですか?
正解:D
Permanent failure - rule auto-disable due to the following reasons The target workspace (on which the rule query operated) has been deleted. The target table (on which the rule query operated) has been deleted. Microsoft Sentinel had been removed from the target workspace. A function used by the rule query is no longer valid; it has been either modified or removed. Permissions to one of the data sources of the rule query were changed. One of the data sources of the rule query was deleted or disconnected. https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom#issue-a-scheduled-rule-failed-to-execute-or-appears-with-auto-disabled-added-to-the-name