Refer to the Exhibit Practice Questions

Refer to the exhibit.
```powershell
Connect-AzAccount
$workspace = Get-AzOperationalInsightsWorkspace -ResourceGroupName "rg-sentinel" -Name "la-sentinel-prod"
Set-AzSentinelSetting -Workspace $workspace -SettingName "Anomalies" -Enabled $true
```

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Malicious IP Login Detection",
    "description": "Detects logins from known malicious IPs",
    "severity": "Medium",
    "enabled": true,
    "query": "SigninLogs | where IPAddress in (dynamic(['10.0.0.1', '192.168.1.1'])) | project TimeGenerated, UserPrincipalName, IPAddress",
    "queryFrequency": "PT5H",
    "queryPeriod": "PT5H",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 0,
    "suppressionDuration": "PT5H",
    "suppressionEnabled": false,
    "tactics": ["InitialAccess"],
    "techniques": ["T1078"],
    "alertRuleTemplateName": null,
    "incidentConfiguration": {
      "createIncident": true,
      "groupingConfiguration": {
        "enabled": false,
        "reopenClosedIncident": false,
        "lookbackDuration": "PT5H",
        "matchingMethod": "AllEntities",
        "groupByEntities": [],
        "groupByAlertDetails": [],
        "groupByCustomDetails": null
      }
    },
    "eventGroupingSettings": {
      "aggregationKind": "SingleAlert"
    }
  }
}
```

Refer to the exhibit.

```kql
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == "0"
| where AppDisplayName == "Office 365 Exchange Online"
| summarize LoginCount = count() by UserPrincipalName, IPAddress
| where LoginCount > 10
| project UserPrincipalName, IPAddress, LoginCount
```

Refer to the exhibit.
```powershell
PS C:\> Get-MpComputerStatus | Select-Object AMProductVersion, AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

AMProductVersion AMServiceEnabled AntivirusEnabled RealTimeProtectionEnabled
--------------- ----------------- ---------------- -----------------------
4.18.2304.9     True              True             False
```

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Malware detected on endpoint",
    "severity": "Medium",
    "queryPeriod": "PT5M",
    "queryFrequency": "PT5M",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 0,
    "query": "DeviceEvents | where ActionType == \"AntivirusDetection\" | where Timestamp > ago(5m)"
  }
}
```

Refer to the exhibit.
```kusto
SecurityIncident
| where Status == "Active" and Severity == "High"
| where CreatedTime > ago(7d)
| summarize Count = count() by Owner
| top 5 by Count desc
```

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspaceName": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
      "name": "[concat(parameters('workspaceName'), '/TestSearch')]",
      "apiVersion": "2020-08-01",
      "properties": {
        "displayName": "Test Search",
        "category": "Test",
        "query": "Heartbeat | summarize Count() by Computer",
        "tags": []
      }
    }
  ]
}

SecurityAlert
| where AlertName == "Malware detected"
| extend entities = parse_json(Entities)
| mv-expand entities
| where entities.Type == "file"
| project FileHash = entities.FileHash, AlertTime = TimeGenerated

Refer to the exhibit.

```kusto
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "cmd.exe")
| extend ParentPID = InitiatingProcessParentFileName
| summarize Count = count() by DeviceName, InitiatingProcessFileName
| where Count > 10
```

Refer to the exhibit.

```json
{
  "properties": {
    "displayName": "Sensitive Data Access Alert",
    "severity": "Medium",
    "query": "OfficeActivity | where Operation == 'FileAccessed' and UserAgent contains 'Microsoft.Copilot' | project TimeGenerated, UserId, FileName",
    "queryFrequency": "PT1H",
    "queryPeriod": "PT1H",
    "triggerOperator": "GreaterThan",
    "triggerThreshold": 5
  }
}
```

Refer to the exhibit.

```powershell
$params = @{
    ResourceGroupName = "SOC-RG"
    WorkspaceName = "sentinel-workspace"
    Name = "DailySummaryReport"
    Enabled = $true
    Description = "Generates daily incident summary"
    DisplayName = "Daily Summary"
    LogicAppResourceId = "/subscriptions/.../resourceGroups/SOC-RG/providers/Microsoft.Logic/workflows/DailySummary"
    TriggerConditions = @(
        @{
            Property = "Microsoft.Security.Incident"
            Condition = "Equals"
            Value = "Medium"
        }
    )
}
New-AzSentinelAutomationRule @params
```

Refer to the exhibit.

```kusto
SecurityAlert
| where TimeGenerated > ago(24h)
| where AlertName == "Suspicious sign-in"
| extend UserPrincipalName = tostring(Entities[0].AccountUpn)
| where UserPrincipalName !endswith "@contoso.com"
| project TimeGenerated, AlertName, UserPrincipalName
```

{
  "properties": {
    "displayName": "SOC Automation Rules",
    "rules": [
      {
        "name": "High Severity Incidents",
        "description": "Assign incidents with severity High to tier1 group and run a playbook.",
        "actions": [
          { "order": 1, "actionType": "AddIncidentTask", "taskName": "Notify SOC Lead" },
          { "order": 2, "actionType": "RunPlaybook", "logicAppResourceId": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Logic/workflows/NotifySOC" },
          { "order": 3, "actionType": "ModifyIncident", "status": "Active", "owner": "SOC-Tier1@contoso.com" }
        ]
      }
    ]
  }
}

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "SOC Automation",
    "description": "Playbook for automated incident response",
    "state": "Enabled",
    "triggers": [
      {
        "type": "Microsoft.SecurityInsights/Incident",
        "conditions": [
          {
            "property": "Severity",
            "operator": "Equals",
            "value": "High"
          },
          {
            "property": "Status",
            "operator": "Equals",
            "value": "New"
          }
        ]
      }
    ],
    "actions": [
      {
        "type": "RunPlaybook",
        "playbookId": "/subscriptions/sub-123/resourceGroups/rg-sentinel/providers/Microsoft.Logic/workflows/playbook-assign-incident"
      }
    ]
  }
}
```

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "Incident Response Workflow",
    "description": "Automates incident response",
    "triggers": [
      {
        "type": "Microsoft.SecurityInsights/Incident",
        "conditions": [
          {
            "property": "Severity",
            "operator": "Equals",
            "value": "Medium"
          },
          {
            "property": "Owner",
            "operator": "Equals",
            "value": "Unassigned"
          }
        ]
      }
    ],
    "actions": [
      {
        "type": "AssignIncident",
        "assignedTo": "soc-team@contoso.com"
      }
    ]
  }
}
```