You have a Microsoft 365 subscription.

Microsoft SC-200 Question Answer

You have a Microsoft 365 subscription. You have the following KQL query.

DeviceEvents

| where ActionType == "AntivirusDetection*

You need to ensure that you can create a Microsoft Defender XDR custom detection rule by using the query.

What should you add to the query?

summarize (Timestamp, DeviceHanw)=arg_min(Timestampf DeviceName), count() by Deviceld

sumarize (Timestamp, ReportId)>arg_max(Timestanp, Reportld), count{) by Deviceld

summarize (Timestamp)=range(Timestatip), count() by Deviceld

sumarize (ReportId)=make_set(ReportId), count() by Deviceld

SC-200 PDF/Engine

Get 60% Discount on All Products, Use Coupon: "8w52ceb345"