Microsoft Security Operations Analyst Associate SC-200 Practice Question

To compare each user's current activity to that same user's historical baseline, you must use the Anomaly rule type in Microsoft Sentinel. An Anomaly rule applies Sentinel's built-in time-series behavioral analytics models to the query's result set, learning normal patterns per entity (such as an individual account) and raising alerts only when the current value significantly deviates from the learned baseline. Scheduled query rules use static or dynamic thresholds that you configure manually, and Fusion or Machine learning rules do not support custom Kusto queries.