MENU
You have a Microsoft 365 subscription. You have the following KQL query.
DeviceEvents
| where ActionType == "AntivirusDetection*
You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query.
What should you add to the query?
Suggested Answer: D
Get Premium SC-200 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
38 comments · newest first
GR
Graciela
11 months ago
Definitely need to summarize by DeviceId, that’s key!
DE
Dean
11 months ago
Wait, are we sure this is the right approach?
ED
Eden
11 months ago
D seems off, not sure it fits the query.
AL
Altha
12 months ago
I think B might be better, but not sure.
SH
Shalon
12 months ago
Looks like option A is the way to go!
LA
Lanie
1 year ago
I’m leaning towards option B, but I’m not sure if the arg_max function is what we need for this scenario. It’s tricky!
TA
Tawny
1 year ago
I feel like I’ve seen something like option D before, but I’m not entirely confident it’s the right choice for creating a custom detection rule.
MA
Martina
1 year ago
I think option A looks familiar, but I’m a bit confused about the syntax. Did we cover that specific format?
RA
Rashida
1 year ago
I remember we practiced a similar KQL query in class, but I’m not sure which summarize function fits best here.
MI
Ming
1 year ago
Ugh, I'm not super familiar with KQL queries and custom detection rules. This is going to require some careful thinking and maybe a quick review of the material. I'll give it my best shot.
CA
Cammy
1 year ago
Okay, let me think this through step-by-step. The key is to understand what the query is doing and how I can transform it to create a custom detection rule. I've got this!
RE
Reena
1 year ago
Hmm, I'm a bit unsure about this one. The question is asking me to modify the query, but I'm not entirely sure what the goal is. I'll need to read through it carefully.
JE
Jenelle
1 year ago
This looks like a pretty straightforward KQL query question. I think I can handle this one.
JO
Jolanda
1 year ago
Hmm, I'm not entirely sure about this. I'll need to think it through and consider the different options carefully.
TW
Twana
1 year ago
This seems like a straightforward question. I think the answer is B - From System and Security, select System.
KA
Kaitlyn
1 year ago
I'm a bit unsure about statement II, though. I remember something about basis recovery but can't recall the exact details.
LO
Lorean
1 year ago
I'm just going to close my eyes and click on an answer. Hopefully, it's the right one, or at least I'll get partial credit for trying.
CO
Cory
1 year ago
This is a tricky one! I'm going to guess option C - 'summarize (Timestamp)=range(Timestamp), count() by DeviceId'. It sounds like it could work, but I'm not 100% sure.
CH
Chantell
1 year ago
Wait, what's 'arg_min' and 'arg_max'? I'm a bit confused by the syntax here. Maybe I should ask the instructor for clarification.
LI
Linwood
1 year ago
Understanding the syntax is important for creating the custom detection rule.
SH
Sharee
1 year ago
Adding arg_min or arg_max can help you refine your query.
LA
Laine
1 year ago
Arg_min and arg_max are functions used to find the minimum and maximum values.
RO
Ronny
1 year ago
C) Adding 'summarize (Timestamp)=range(Timestamp), count() by DeviceId' will help you create the Microsoft Defender XDR custom detection rule.
NI
Nickie
1 year ago
You can ask the instructor for clarification.
DE
Delsie
1 year ago
B) 'arg_min' and 'arg_max' are functions used to find the minimum and maximum values in a column. You can ask the instructor for clarification.
KA
Kallie
1 year ago
A) You should add 'summarize (Timestamp, DeviceName)=arg_min(Timestamp, DeviceName), count() by DeviceId' to the query.
TO
Tonja
1 year ago
Aha, I've seen this kind of query before! I'm going to go with option D - 'summarize (ReportId)=make_set(ReportId), count() by DeviceId'. It seems to be the most relevant for creating a custom detection rule.
CL
Clorinda
1 year ago
Yes, option D makes sense for adding to the query to create the custom detection rule.
LU
Lucia
1 year ago
I agree, option D seems to be the most suitable for creating the custom detection rule with Microsoft Defender XDR.
GE
Geraldine
1 year ago
I think option D is the right choice too. It looks like it will help create the custom detection rule.
TH
Thomasena
2 years ago
Hmm, I'm not sure. I think I need to read up more on Microsoft Defender XDR custom detection rules. This query looks a bit complex.
DE
Detra
1 year ago
User1: Let's try adding it and see if it works for the custom detection rule.
TH
Thersa
1 year ago
User3: I agree. Adding that to the query will ensure the rule is effective.
MA
Marta
1 year ago
User2: That makes sense. It will help create the Microsoft Defender XDR custom detection rule.
VO
Von
1 year ago
User1: I think you should add 'summarize (Timestamp)=range(Timestamp), count() by DeviceId' to the query.
VA
Valene
2 years ago
I'm not sure, but I think D) summarize (ReportId)=make_set(ReportId), count() by DeviceId could also work.
VE
Veta
2 years ago
I agree with Trinidad. Adding range(Timestamp) will help create the custom detection rule.
TR
Trinidad
2 years ago
I think the correct answer is C) summarize (Timestamp)=range(Timestamp), count() by DeviceId.