Microsoft Sentinel Analytics Rule Types Explained
Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?
Quick Answer
The answer is a scheduled query rule. This rule type is correct because it runs at defined intervals—such as every five minutes—and can aggregate log data to count events like failed sign-ins from a single IP address, then trigger an incident when a threshold (more than 10) is exceeded. On the SC-900 exam, this question tests your understanding of the core analytics rule types in Microsoft Sentinel, specifically distinguishing scheduled queries from near-real-time (NRT) rules, which lack robust aggregation, and from machine learning or fusion rules that rely on different detection methods. A common trap is choosing NRT because it sounds faster, but remember: scheduled queries are designed for threshold-based, time-window aggregations. Memory tip: “Schedule your thresholds” — if you need to count events over time, schedule it.
⚠ Common exam trap
It's easy for candidates to confuse NRT rules with scheduled queries, assuming NRT means 'real-time thresholding,' but NRT rules cannot perform multi-minute aggregations and are limited to single-event or simple pattern matching.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Scheduled query rule
A scheduled query rule is correct because it allows you to define a KQL query that counts failed sign-ins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the requirement specifies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Fusion rule
Why it's wrong here
Incorrect: Fusion correlates multiple alerts, not a single threshold condition.
- ✓
Scheduled query rule
Why this is correct
Correct: Scheduled rules allow aggregation (e.g., count>10) over time windows.
- ✗
Near-real-time (NRT) rule
Why it's wrong here
Incorrect: NRT rules have limited aggregation capabilities for complex thresholds.
- ✗
ML Behavior Analytics rule
Why it's wrong here
Incorrect: ML rules use anomaly detection, not fixed thresholds.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management (SIEM) and security orchestration automation and response (SOAR) service that helps organizations detect, investigate, and respond to cyber threats across their entire digital estate.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?
hard- A.Sign-ins with high sign-in risk from any location
- B.Sign-ins with medium or high risk from the US
- C.Sign-ins from users with high user risk outside the US
- ✓ D.Sign-ins with medium or high risk from outside the US
Why D: The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.
Variation 2. Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?
hard- A.To identify all files shared externally regardless of sensitivity
- B.To automatically block external sharing of sensitive files
- ✓ C.To detect when a file labeled 'Highly Confidential' is shared externally
- D.To list all alerts generated by the rule
Why C: The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.
Variation 3. You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?
hard- ✓ A.Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.
- B.Identify all sign-in attempts from a specific IP address.
- C.Identify impossible travel activity across different locations.
- D.Identify locations with the highest number of failed sign-ins.
Why A: The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.
Variation 4. Refer to the exhibit. You are analyzing a Microsoft Sentinel workspace using KQL. The query returns no results, but you know that malware alerts have been generated today. What is the most likely reason?
hard- A.The table does not contain a 'AlertSeverity' column.
- B.The 'order by' clause is invalid.
- C.The time range is too short.
- ✓ D.The column name 'AlertName' is incorrect.
Why D: The `SecurityAlert` table in Microsoft Sentinel does contain a column for the alert's name. While `AlertName` is the standard column name, KQL is case-sensitive for column names. If the actual column name in the specific Sentinel workspace's `SecurityAlert` table has a different casing (e.g., `alertName` or `Alertname`), or if there is a subtle typo in the query's `AlertName`, then the query will fail to find the column and return no results. Therefore, option D, "The column name 'AlertName' is incorrect," is the most likely reason for the query returning no results, assuming the alerts exist and the time range is sufficient. Options A, B, and C are incorrect because 'AlertSeverity' is a valid column, the query does not contain an 'order by' clause, and `ago(1d)` should cover alerts generated today.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.