I've got a good feeling about this one. The key details are the Continuous Pipeline Mode and the mix of STREAMING LIVE TABLE and LIVE TABLE datasets. I think option C is the most likely outcome, but I'll double-check my reasoning before submitting my answer.
I'm a bit confused by some of these options. Lindbergh flying combat missions doesn't seem right, and I'm not sure about the honorary degree either. I'll have to carefully consider the chronology here.
Okay, let me think this through. I believe the answer is to configure the Diagnostics settings in Azure AD to stream the events to an event hub, which the SIEM solution can then ingest. That seems like the most efficient way to get the data to the SIEM in near real-time.
Sharen
4 months agoEvan
4 months agoMarnie
5 months agoErnest
5 months agoElenora
5 months agoLorean
5 months agoMalcom
5 months agoXochitl
5 months agoAlpha
5 months agoLeonardo
5 months ago