Microsoft Security Operations Analyst Associate SC-200 Practice Question

The anti join operator excludes records in the left table that also appear in the right table. In a hunting scenario, you can join the live data set (for example, AzureActivity) with the SecurityAlert or HuntingBookmark tables that contain events you have already triaged. By performing a left-anti join, the query outputs only new, un-bookmarked events. Other joins such as innerunique or inner return matching rows rather than excluding them, while union combines sets without filtering duplicates. The project-away statement merely removes columns and does not prevent previously investigated events from reappearing.