Microsoft Security Operations Analyst Associate SC-200 Practice Question

When you create a custom detection rule that runs against device-related tables (such as DeviceProcessEvents), Microsoft Defender XDR requires the query to return at least the Timestamp column, which indicates when the event occurred, and the DeviceId column, which identifies the affected device. Without both of these mandatory columns, the rule cannot correlate results to specific devices or determine alert time, and the rule creation wizard will not let you proceed. Other columns-such as ReportId, FileName, or Severity-are optional but not required for the rule to run.