You are a SOC Analyst working at a company that is deploying Azure Sentinel.
You are responsible for performing log data analysis to search for malicious activity, display visualizations, and perform threat hunting.
To query log data, you use the Kusto Query Language (KQL)
Often fields in a table store structured and unstructured string data.
You write KQL statements to extract and manipulate data stored in these fields.
Which of the following items contains a Dynamic field?
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: C Option C is correct.
The properties in the field are accessed with the dot notation.
Option A, B and D are incorrect.
The data in the field is a string of key-value pairs.
Reference:
In the context of log data analysis in Azure Sentinel using Kusto Query Language (KQL), a dynamic field is a field that allows for the storage of complex and varying data types, such as structured and unstructured string data. Dynamic fields are useful in scenarios where the data being stored can change over time, making it difficult to predict the exact data type in advance.
Based on the options provided, the item that contains a dynamic field is "C. Key-value pair data". Key-value pair data is a type of data structure where each record or data point is represented as a key-value pair, where the key is a unique identifier and the value is the data associated with that identifier. Key-value pairs can be used to store both structured and unstructured data, making them a flexible and dynamic way to store data.
External data refers to data that is sourced from outside of Azure Sentinel, such as data from third-party applications or services. Calculated data refers to data that is derived from other data sources and calculated using predefined formulas or rules. Internal data refers to data that is generated within Azure Sentinel, such as log data generated by various sources within an organization.
In summary, the key-value pair data item contains a dynamic field, which allows for the storage of complex and varying data types. This makes it a useful data structure for log data analysis in Azure Sentinel using Kusto Query Language (KQL).