Security Operations Analyst (SC-200) Exam Questions

Domain 1: Manage a security operations environment (42%)

---

A SOC manager wants the on-call lead emailed whenever a High severity incident is created in Microsoft Defender XDR. The lead should get one email per incident rather than a new email every time another alert is correlated into it. A regional analyst who is scoped by RBAC to only the “APAC” device groups is also on the recipient list and should only hear about incidents for devices they’re allowed to see. What should be configured?

⬜ An alert notification rule in Defender for Endpoint for every device group, set to all severities
⬜ An incident email notification rule in Microsoft Defender XDR, filtered to High severity with “Send only one notification per incident” enabled
⬜ A Microsoft Sentinel automation rule that runs a playbook to email the lead for every new alert
⬜ Threat analytics email notifications for newly published reports

A vulnerability-scanning server runs an authorized PowerShell-based inventory script every night, and Microsoft Defender XDR raises the same low-fidelity alert for it each time. The SOC has confirmed the activity is benign. They want new alerts that match this exact condition to be resolved automatically so they stop cluttering the queue, but the detection must stay active for every other device. What should the SOC configure?

⬜ Turn the detection off for the whole tenant in Defender for Endpoint advanced features
⬜ Set the automation level for every device group to “No automated response”
⬜ An alert tuning rule (formerly alert suppression) with the “Resolve alert” action, scoped to the matching conditions
⬜ An “Allow” file indicator for powershell.exe across the organization

Tier-3 responders need to run an in-house, unsigned PowerShell collection script through live response on both Windows 11 workstations and Windows Server machines. Live response sessions already work on workstations, but responders can’t open sessions on servers, and the unsigned script is refused even on workstations. Which Microsoft Defender for Endpoint advanced features must be turned on in addition to “Live response”?

⬜ Tamper protection and EDR in block mode
⬜ Live response for servers, and Live response unsigned script execution
⬜ Automatically resolve alerts, and Allow or block file
⬜ Web content filtering, and Custom network indicators

A security team wants to enable the attack surface reduction (ASR) rule “Block all Office applications from creating child processes,” but the finance department relies heavily on legacy macros. Before blocking anything, the team wants to measure exactly which processes the rule would have stopped, without affecting users at all, and then review the results in advanced hunting. What should they do?

⬜ Deploy the rule in Audit mode, then query advanced hunting for the AsrOfficeChildProcessAudited action type
⬜ Deploy the rule in Warn mode so users can decide whether to continue
⬜ Deploy the rule in Block mode with all Office applications added as exclusions
⬜ Leave the rule off and rely on EDR in block mode to report what would have been blocked

An analyst creates a Microsoft Defender for Endpoint file hash indicator with the “Block and remediate” action for a malicious executable. Hours later, the file still runs on onboarded Windows devices where Microsoft Defender Antivirus is in active mode. The analyst discovers that one tenant-level setting was never turned on. What is the most likely fix?

⬜ Recreate the indicator as a certificate indicator with the “Warn” action
⬜ Request an increase to the tenant’s 15,000-indicator limit
⬜ Convert the indicator into a custom network indicator for the file’s download URL
⬜ Turn on the “Allow or block file” advanced feature and make sure cloud-delivered protection is enabled

A company wants automated investigation and remediation (AIR) in Microsoft Defender for Endpoint to remediate malicious files automatically in most locations. However, any remediation that touches files in core operating system directories such as \windows\* must wait for an analyst’s approval in the Action center. Which automation level should be assigned to the relevant device group?

⬜ Full - remediate threats automatically
⬜ Semi - require approval for core folders remediation
⬜ Semi - require approval for all folders
⬜ No automated response

A company has turned on automatic attack disruption in Microsoft Defender XDR. The payroll team is worried that a critical service account running overnight batch jobs could be disabled or contained automatically during a suspected attack, causing a payroll outage. They want disruption to keep protecting every other user and device, but never act automatically on that one account. What should the SOC do?

⬜ Add the service account to the automated response exclusions for attack disruption
⬜ Turn off automatic attack disruption for the whole tenant
⬜ Set every Defender for Endpoint device group to “No automated response”
⬜ Tag the service account as a sensitive account in Microsoft Defender for Identity

An authorized penetration test runs for five days. During it, a Microsoft Sentinel analytics rule will repeatedly generate incidents involving the testers’ IP address. The SOC wants those specific incidents closed automatically as Benign Positive during the test window only. They don’t want to modify or disable the analytics rule, and the auto-closing should stop by itself when the test ends. What should they create?

⬜ Disable the analytics rule for five days and re-enable it afterward
⬜ Turn on query suppression in the analytics rule’s settings
⬜ An automation rule, triggered when an incident is created, with conditions on the analytics rule and the tester IP entity, a “Change status to Closed” action, and an expiration date set to the end of the test
⬜ A playbook that analysts run manually on each incident

A security engineer builds a Microsoft Sentinel playbook in a dedicated “SOC-Playbooks” resource group and tries to add it to an automation rule. The playbook can’t be selected, and Sentinel reports that it doesn’t have permissions on that resource group. What must be done so automation rules can run playbooks from this resource group?

⬜ Assign the engineer the Microsoft Sentinel Playbook Operator role on the resource group
⬜ Have an Owner or User Access Administrator grant Microsoft Sentinel the Microsoft Sentinel Automation Contributor role on the SOC-Playbooks resource group
⬜ Assign the engineer the Logic App Contributor role on the Sentinel workspace
⬜ Rebuild the playbook as a Standard logic app instead of Consumption

New tier-1 analysts in Microsoft Sentinel must be able to assign, tag, and close incidents and manually run existing playbooks on alerts and entities. They must not be able to create or edit analytics rules or edit playbooks. Following least privilege, which two roles should they be assigned? (Choose 2.)

⬜ Microsoft Sentinel Responder
⬜ Microsoft Sentinel Contributor
⬜ Microsoft Sentinel Playbook Operator
⬜ Logic App Contributor

A regulator requires a bank to keep firewall logs for seven years. The SOC only needs those logs for real-time analytics and hunting for the most recent 90 days, and older data is queried only occasionally for forensic investigations. What is the most cost-effective way to meet both requirements in Microsoft Sentinel?

⬜ Set analytics tier retention on the firewall table to seven years
⬜ Keep analytics tier retention at 90 days and extend total retention in the Microsoft Sentinel data lake tier to seven years
⬜ Rely on Defender XDR advanced hunting, which keeps data for seven years by default
⬜ Set the table to the XDR default tier, which retains data indefinitely at no cost

A SOC manager is under pressure to reduce Microsoft Sentinel ingestion costs. They want built-in guidance tailored to their own workspace that shows which ingested tables deliver little security value (for example, tables not used by any analytics rules), and where detection coverage is weak for specific attack types such as human-operated ransomware. Which feature should they use?

⬜ Azure Advisor cost recommendations
⬜ The Microsoft Sentinel workbooks gallery
⬜ SOC optimization recommendations
⬜ The Content hub “installed solutions” list

An organization runs its domain controllers on premises, not in Azure. To control costs, it wants Microsoft Sentinel to collect only a specific set of Windows Security event IDs (such as 4624, 4625, and 4688) from those servers using the currently supported agent. What should the engineer do?

⬜ Install the legacy Log Analytics agent and choose the “Common” event set
⬜ Configure the Syslog via AMA connector on each domain controller
⬜ Onboard the servers to Azure Arc, then use the Windows Security Events via AMA connector with the “Custom” event set and XPath queries in the data collection rule
⬜ Use the Windows Security Events via AMA connector with the “All” event set and delete unwanted rows after ingestion

A Linux log forwarder runs the Azure Monitor Agent with two data collection rules: one for the Common Event Format (CEF) via AMA connector and one for the Syslog via AMA connector. Both collect the local4 facility. The SOC notices that every firewall event now appears twice, once in CommonSecurityLog and once in Syslog. What is the correct fix?

⬜ Change the syslog daemon’s listening port from 514 to 28330
⬜ Stop using the same facility in both the CEF via AMA and Syslog via AMA data collection rules
⬜ Replace rsyslog with syslog-ng on the forwarder
⬜ Move the log forwarder to a Windows Server machine

A Sentinel engineer uses the Azure Policy-based configuration to stream Azure activity logs and resource diagnostic logs into the Sentinel workspace. Resources created after the policy assignment send logs as expected, but resources that already existed before the assignment send nothing. What did the engineer miss?

⬜ Selecting “Create a remediation task” on the Remediation tab so the policy is also applied to existing resources
⬜ Assigning the Microsoft Sentinel Responder role to every subscription owner
⬜ Installing the Azure Monitor Agent on every existing Azure resource
⬜ Waiting 14 days for Azure Policy to back-fill existing resources automatically

A financial-sector information sharing group publishes STIX threat indicators from a TAXII 2.1 server. The SOC wants those indicators imported into Microsoft Sentinel automatically and refreshed on a schedule. Besides installing the Threat Intelligence solution from Content hub, what information is needed to configure the import connector?

⬜ The partner’s Azure subscription ID and a shared Log Analytics workspace key
⬜ A storage account SAS token for a container holding STIX bundle files
⬜ A Microsoft Defender for Endpoint API client secret for custom indicators
⬜ The TAXII server’s API root URL and collection ID, plus a username and password if the server requires them

A Sentinel engineer needs a new custom table in the Log Analytics workspace to hold JSON logs from an in-house application that will be sent through the Logs ingestion API. They create it in the Azure portal. Which statement about the resulting table is correct?

⬜ The table name automatically gets a _CF suffix
⬜ The table name gets a _CL suffix, and creating it in the portal involves a data collection rule, a data collection endpoint, and a sample JSON file to define the schema
⬜ Custom tables must use the Basic plan and can’t use the Analytics plan
⬜ The table doesn’t need a TimeGenerated column, because timestamps are optional in Azure Monitor Logs

A threat hunter wants to turn an advanced hunting query on the DeviceProcessEvents table into a Microsoft Defender XDR custom detection rule that automatically isolates the affected device. The query currently projects only DeviceName and ProcessCommandLine, and the rule can’t be set up properly. Which columns should the query return?

⬜ AlertId and IncidentId
⬜ Only TimeGenerated
⬜ Timestamp, ReportId, and DeviceId
⬜ SentinelScope_CF

A security team must be alerted within roughly a minute or two whenever an emergency “break-glass” administrator account signs in. The detection runs in Microsoft Sentinel against sign-in logs, which arrive with low ingestion delay. Which type of Sentinel analytics rule fits this requirement best?

⬜ A near-real-time (NRT) analytics rule
⬜ A scheduled analytics rule with the query frequency set to 1 minute
⬜ A customizable anomaly rule in Production mode
⬜ A summary rule that aggregates sign-ins every 20 minutes

A detection engineering lead wants a matrix view of which MITRE ATT&CK techniques are covered by the scheduled and near-real-time rules currently enabled in Microsoft Sentinel. They also want to see how much coverage they would gain by enabling the analytics rule templates they haven’t turned on yet. Which Sentinel feature provides this?

⬜ Threat analytics reports in Microsoft Defender XDR
⬜ The UEBA entity page for the organization’s top users
⬜ The Content hub solution details page
⬜ The MITRE ATT&CK page, showing active and simulated coverage

A built-in Microsoft Sentinel anomaly rule generates far more anomalies than the SOC considers useful. The team wants to raise its threshold, compare the tuned version’s results against the original for a while, and only then swap it in. What is the correct approach?

⬜ Edit the threshold directly on the built-in anomaly rule and save it
⬜ Duplicate the anomaly rule, adjust the threshold on the customized copy, run it in Flighting mode alongside the original, then switch it to Production
⬜ Convert the anomaly rule into a near-real-time (NRT) rule
⬜ Disable UEBA so the anomaly rule stops generating results

Domain 2: Respond to security incidents (36%)

---

A credential-phishing email was delivered to 350 mailboxes before detection caught up. Using Microsoft Defender for Office 365 Plan 2, the SOC wants to remove every delivered copy from users’ mailboxes in one bulk operation while keeping the ability to recover messages if any turn out to be legitimate. What should the analyst do?

⬜ Create an Exchange mail flow rule to block the sender going forward
⬜ In Threat Explorer, select the messages and use Take action to soft delete them (or move them to Deleted items), with the action tracked in the Action center
⬜ Ask every affected user to report the message as junk
⬜ Add the sender’s domain to the Tenant Allow/Block List and wait for it to purge delivered mail

A company with Microsoft 365 E5 wants a compliance-focused analyst to view and manage Microsoft Purview data loss prevention (DLP) alerts in the Microsoft Defender portal’s incident queue. Following least privilege, the analyst should see DLP alerts only, not every other security alert. Which permission fits best?

⬜ Manage Alerts
⬜ eDiscovery Manager
⬜ Information Protection Analyst
⬜ Security Administrator

Microsoft Defender for Servers repeatedly raises the same alert type for an approved administrative script on a group of Azure VMs. The SOC has confirmed it’s benign. Future alerts matching this exact pattern should be dismissed automatically, but still kept for audit, and the rule should lapse at the end of the quarter. What should the team configure in Microsoft Defender for Cloud?

⬜ A suppression rule with matching conditions, a reason, and an expiration date
⬜ Turn off the Defender for Servers plan on those VMs
⬜ Manually delete each alert as it arrives
⬜ A secure score exemption on the related recommendation

Microsoft Defender for Cloud Apps flags a user for an impossible-travel sign-in followed by a mass download from a connected cloud app. While the investigation continues, the analyst wants to immediately invalidate every refresh token and session cookie the user holds, forcing them to sign in again everywhere, but without blocking the account. Which governance action fits?

⬜ Suspend user
⬜ Require user to sign in again
⬜ Notify user
⬜ Ban app

After investigating a Microsoft Entra ID Protection risky user report, an administrator concludes the account really was compromised and selects “Confirm user compromised.” What does this action do on its own?

⬜ It resets the user’s password and revokes all sessions automatically
⬜ It closes the risk event and returns the user to a safe state
⬜ It sets the user’s risk state to “Confirmed compromised,” but the admin must still secure the account, for example by resetting the password, revoking sessions, or blocking the user
⬜ It permanently deletes the user object from Microsoft Entra ID

Microsoft Defender for Identity raises a high-severity alert titled “Suspected DCSync attack (replication of directory services).” The source is an ordinary employee workstation. What triggered the alert, and what does Microsoft suggest to prevent it?

⬜ A forged Kerberos TGT was used beyond its maximum lifetime; rotate the KRBTGT account password
⬜ An account with Kerberos preauthentication disabled was targeted; enable preauthentication
⬜ A decoy honeytoken account attempted to authenticate; delete the honeytoken
⬜ A directory replication request came from a computer that isn’t a domain controller; review who holds the “Replicate directory changes” and “Replicate directory changes all” permissions

An analyst is investigating a Microsoft Sentinel incident and wants to see, without writing any query, up to 20 other incidents that most closely resemble this one. That way they can check how comparable cases were classified and handled. Where on the incident details page is this information?

⬜ The Similar incidents widget
⬜ The Top insights panel
⬜ The Activity log
⬜ The Logs panel

A tenant has Microsoft Security Copilot provisioned. An analyst opens a Microsoft Defender XDR incident that contains 60 correlated alerts. Which statement correctly describes the incident summary feature built into the Defender portal?

⬜ It only works in the standalone Security Copilot portal and needs a hand-written prompt
⬜ It only supports incidents with 10 or fewer alerts
⬜ It automatically closes the incident once the summary is generated
⬜ By default it generates a summary automatically when the incident is opened, covering incidents with up to 100 alerts, and includes the attack timeline, affected assets, and indicators of compromise

During a multi-stage incident in Microsoft Defender XDR, an attacker compromised one user and moved laterally to two servers. The analyst wants to see not just what’s already affected, but also the possible propagation paths from a compromised node to the organization’s critical assets, all in one graph on the incident page. Which capability provides this?

⬜ The device timeline of the first compromised server
⬜ Blast radius analysis in the incident graph
⬜ The threat analytics “Analyst report” tab
⬜ An alert tuning rule

One threat actor campaign has produced five separate incidents over three weeks. The SOC lead wants a single container in the Microsoft Defender portal that links all five incidents and the related indicators of compromise, with its own tasks (each with an owner and due date), a priority, and custom statuses that match the SOC’s process, all without a third-party ticketing tool. What should they use?

⬜ A Microsoft Sentinel workbook
⬜ A shared tag on all five incidents
⬜ A threat analytics report
⬜ A case in the Defender portal’s case management

An external incident response firm has asked for a record of everything that happened on one compromised Windows device during a specific five-day window two weeks ago, with the most significant events highlighted. What is the most direct way to produce this in Microsoft Defender for Endpoint?

⬜ On the device page’s Timeline, set a custom date range, flag the key events, and export the timeline (an export can cover up to seven days)
⬜ Collect an investigation package from the device
⬜ Run a full antivirus scan and export the scan report
⬜ Start a live response session and run processes

During a live response session on a Windows device, a responder tries to run a remediation PowerShell script with the run command, but the command fails because the script can’t be found. The script exists only on the responder’s own laptop. What should the responder do first?

⬜ Use getfile to copy the script from the laptop to the device
⬜ Upload the script to the live response library, then use run (unsigned script execution must also be enabled if the script is unsigned)
⬜ Run processes to load the script into memory
⬜ Collect an investigation package so the script is included in it

A Windows 11 laptop is suspected of being compromised, and the analyst wants to cut it off from the network immediately. However, the executive using it must keep working in Outlook and Microsoft Teams while the investigation runs. Which Microsoft Defender for Endpoint response action fits?

⬜ Full device isolation
⬜ Restrict app execution
⬜ Selective isolation
⬜ Contain device

A malicious, non-Microsoft-signed DLL is found running on 40 devices. The analyst wants a single file-level action that stops the running processes, quarantines the file, and deletes persistence data such as related registry keys on every affected device. Which action should be used?

⬜ Stop and quarantine file
⬜ Deep analysis
⬜ Download file
⬜ Collect investigation package

An incident titled “Human-operated ransomware attack… (attack disruption)” shows that Microsoft Defender XDR automatically contained a file server and disabled a user account. After investigating and cleaning up, the SOC confirms both assets are safe. How should the SOC bring them back?

⬜ Offboard and re-onboard the server to Defender for Endpoint
⬜ Wait seven days for containment to expire automatically
⬜ Undo the automatic disruption actions from the Action center
⬜ Delete the incident, which reverses all actions attached to it

While investigating a compromised mailbox with Microsoft Purview Audit, an analyst finds MailItemsAccessed records whose access type is Sync for the Inbox folder. The attacker’s session also shows several Bind records. How should these records be interpreted?

⬜ Sync records identify each individual message the attacker opened, and Bind records mean the whole folder was downloaded
⬜ A Sync record means an entire folder was synchronized, so every item in it should be treated as compromised. Bind records represent access to individual messages and include each message’s InternetMessageId
⬜ MailItemsAccessed only records access through Outlook on the web, so desktop-client access is missing
⬜ MailItemsAccessed only records successful message deletions

An analyst uses Microsoft Purview eDiscovery to find every email across the organization’s mailboxes that has a specific phishing subject line and came from a known malicious sender. They’re building the search with Keyword Query Language (KeyQL) in the current eDiscovery experience. Which statement about building this query is correct?

⬜ Classic Content Search is still the recommended tool for this in the Microsoft Purview portal
⬜ Boolean operators can be written in any case, such as and or or
⬜ Suffix wildcards such as *voice are supported for matching the end of words
⬜ Boolean operators such as AND, OR, and NOT must be uppercase, and only prefix wildcards (such as invoice*) are supported

A SOC suspects that a compromised app registration is quietly enumerating users and groups through Microsoft Graph. The team needs a per-request audit trail of Graph API calls, including request URI, HTTP method, app ID, caller IP, and response status code, that can be queried with KQL in their Log Analytics workspace. What should they configure?

⬜ Export Microsoft Entra sign-in logs to Log Analytics
⬜ Diagnostic settings that send Microsoft Graph activity logs to the Log Analytics workspace, where they appear in the MicrosoftGraphActivityLogs table
⬜ Enable Microsoft Purview Audit (Premium) for the app’s service principal
⬜ Deploy Microsoft Defender for Endpoint on the app’s hosting server

Domain 3: Perform threat hunting (22%)

---

A threat hunter wants to find every user who clicked a malicious link delivered in email and rewritten by Safe Links, including clicks made from Teams and Office apps. Which Microsoft Defender XDR advanced hunting table should the query start from?

⬜ EmailUrlInfo
⬜ UrlClickEvents
⬜ DeviceNetworkEvents
⬜ IdentityLogonEvents

A hunting query over 30 days of DeviceProcessEvents filters with where ProcessCommandLine contains "mimikatz" and runs slowly. The hunter only needs to match “mimikatz” as a whole word, bounded by non-alphanumeric characters as in mimikatz.exe. Which change will most likely make the query faster?

⬜ Replace contains with matches regex "mimikatz"
⬜ Replace contains with has
⬜ Replace contains with contains_cs
⬜ Replace contains with !contains

A hunter runs this advanced hunting query: IdentityLogonEvents | where ActionType == "LogonFailed" | summarize FailedAccounts = dcount(AccountUpn) by IPAddress | where FailedAccounts > 20. What activity is it designed to surface?

⬜ Accounts that failed to sign in more than 20 times
⬜ Source IP addresses that had failed sign-ins against more than 20 distinct accounts, a typical password-spray pattern
⬜ IP addresses with more than 20 successful sign-ins
⬜ The 20 most recent failed sign-ins in the tenant

A newly hired tier-1 analyst has little Kusto Query Language experience but must start hunting in Microsoft Defender XDR advanced hunting. Which statement about advanced hunting is correct?

⬜ Native Defender XDR data is kept for 180 days
⬜ Queries can return an unlimited number of rows
⬜ A guided mode lets users build queries without writing KQL, and native Defender XDR data is available for the past 30 days
⬜ Microsoft Sentinel workspace data can never be queried from advanced hunting

Microsoft publishes a new threat analytics report about a ransomware activity group. The CISO asks two questions: how many of our devices are exposed to this threat, and are the relevant security updates deployed? Which section of the report answers this?

⬜ Analyst report
⬜ Related incidents
⬜ Endpoints exposure
⬜ Indicators

A threat hunter wants to find every non-privileged user who has a potential privilege-escalation path to Domain Admins. They’d rather explore the results as an interactive node-and-edge visualization, starting from a prebuilt scenario instead of writing complex KQL joins. Which capability fits?

⬜ The incident graph of an existing incident
⬜ The MITRE ATT&CK coverage page in Microsoft Sentinel
⬜ The device timeline of a domain controller
⬜ The hunting graph in advanced hunting, using the prebuilt “Paths to domain admins” scenario

A SOC finds that the hunting graph and the blast radius view on incident pages aren’t available in its Microsoft Defender portal. Both experiences are powered by Microsoft Sentinel graph. What does Microsoft document as the way to enable them?

⬜ Enable User and Entity Behavior Analytics (UEBA) in the Sentinel workspace
⬜ Complete the Microsoft Sentinel data lake onboarding flow, after which the hunting graph and blast radius experiences are provisioned automatically
⬜ Install a “Sentinel Graph” solution from Content hub
⬜ Enable the Defender CSPM plan on every Azure subscription

While running Microsoft Sentinel hunting queries, an analyst finds several suspicious results and bookmarks them. Which two statements about hunting bookmarks are correct? (Choose 2.)

⬜ You can create a new incident from one or more bookmarks
⬜ Bookmarked results are stored in the HuntingBookmark table, where they can be correlated with other data
⬜ Bookmarking a result automatically creates and enables a matching analytics rule
⬜ Bookmarks are deleted automatically after 24 hours

A SOC stores two years of firewall logs in the Microsoft Sentinel data lake tier. Every day, it wants to match that long history against current threat intelligence indicators and write any matches to a table in the analytics tier, where detection rules and analysts can use them quickly. What should it set up?

⬜ A near-real-time analytics rule that queries the data lake tier directly
⬜ A Defender XDR advanced hunting query saved as a favorite
⬜ A scheduled KQL job in the data lake whose results are written to an analytics tier table (a new table gets a _KQL_CL suffix)
⬜ A Microsoft Sentinel workbook pinned to the SOC dashboard

A SOC keeps very high-volume network flow logs in a low-cost tier to control costs. Hunters want an hourly, aggregated view (for example, connection counts per source IP) in a fast Analytics-plan table for quick hunting and threat intelligence matching, while the raw logs stay in the cheap tier. Which Microsoft Sentinel feature is designed for this?

⬜ Summary rules, which aggregate the data on a schedule into a custom _CL table on the Analytics plan
⬜ Moving every raw flow log into the analytics tier
⬜ A data collection rule transformation that drops all flow logs
⬜ Increasing the workspace’s analytics tier retention to two years

A threat hunter works in Visual Studio Code with GitHub Copilot and Jupyter notebooks. They want to ask natural-language questions about security data in the Microsoft Sentinel data lake, and eventually build Security Copilot agents, without writing KQL or learning every table schema. What should they connect their AI client to?

⬜ A Microsoft Sentinel workbook
⬜ An Azure Logic Apps playbook
⬜ Advanced hunting guided mode in the Defender portal
⬜ The Microsoft Sentinel MCP server, using its data exploration tool collection