I feel pretty confident about this one. The question is clearly focused on the display of the user ID, so the number of DETs should be based on that function. I'll go with option A.
Hmm, I'm a bit unsure about IoC Type and Cyber Kill Chain Step. Are those also considered baseline classifications? I'll have to think this through carefully.
Okay, I think I've got this. The key is to use the Microsoft Monitoring Agent on the VM to send the event log data to an Azure storage account, and then configure the alert in Azure Monitor to look for the specific event pattern. The SAS is just to give the agent access to the storage account. I feel pretty confident about this approach.
upvoted 0 times
...
Log in to Pass4Success
Sign in:
Report Comment
Is the comment made by USERNAME spam or abusive?
Commenting
In order to participate in the comments you need to be logged-in.
You can sign-up or
login
Annamaria
4 months agoFelicidad
4 months agoBroderick
4 months agoCristen
4 months agoFrederica
5 months agoMagnolia
5 months agoValentine
5 months agoAlton
5 months agoAlonso
5 months agoMartina
5 months agoElvis
5 months agoHana
5 months agoMelina
5 months ago