Q41 Monitor Domain 4 · 20–25% of exam

Which Azure Monitor feature detects anomalous user behaviour patterns and potential security threats in application logs?

  1. A Smart Detection
  2. B Microsoft Sentinel (SIEM) (correct answer)
  3. C Failure Anomalies detector
  4. D Log Analytics security solution

Shortcut: Microsoft Sentinel is Azure's SIEM/SOAR. It ingests logs from many sources (including Log Analytics/Application Insights) and applies ML and analytics rules to detect security threats.