MENU
You recently deployed Azure Sentinel.
You discover that the default Fusion rule does not generate any alerts. You verify that the rule is enabled.
You need to ensure that the Fusion rule can generate alerts.
What should you do?
Suggested Answer: B
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
WI
Wilburn
12 months ago
Seems odd that the default rule doesn't generate alerts by itself!
MI
Mica
1 year ago
Wait, does anyone actually use hunting bookmarks for this?
LA
Lavonda
1 year ago
I thought disabling and re-enabling might help too.
JO
Joanne
1 year ago
Totally agree, B is the way to go!
EL
Eliz
1 year ago
You need to add data connectors for Fusion to work.
BR
Brynn
1 year ago
Adding a hunting bookmark doesn't sound like it would help with generating alerts for the Fusion rule, but I could be wrong.
NO
Noah
1 year ago
I practiced a similar question where we had to ensure alerts were generated, but I can't recall if creating a new machine learning rule was necessary.
TY
Tyra
1 year ago
I'm not entirely sure, but I think disabling and re-enabling the rule might reset something. It seems like a common troubleshooting step.
CO
Cordelia
1 year ago
I remember reading that Fusion rules rely on data from various sources, so maybe adding data connectors is the right move?
AN
Annice
1 year ago
Ah, I think I know this one. It's got to be the /opt/PTA/emailConfiguration.sh script, right?
KA
Kandis
1 year ago
Okay, I've got a strategy. I'll start by looking at the method signature and considering whether making it global static instead of public static could be one of the changes. Then I'll look at the argument type and see if changing that could be the other change needed.