Q50
Hotspot
HOTSPOT
You have an Azure subscription that contains a user named User1 and a Microsoft Sentinel workspace named WS1.
You deploy Advanced Security Information Model (ASIM) authentication parsers to WS1.
You need to use the parsers to query the authentication events generated by User1 during the last 24 hours. The solution must maximize the performance of the query.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Select the correct area(s) on the image.
