Explanation:

Explanation:

In Azure Security Center (now Microsoft Defender for Cloud), Workflow automation is provisioned as an ARM resource of type Microsoft.Security/automations. The automation resource defines one or more actions, and when the action is a Logic App, the actionType is set to LogicApp and the action must reference the Logic App by its resource ID. In ARM, the correct provider namespace for Logic Apps is Microsoft.Logic, so the template uses resourceId('Microsoft.Logic/workflows', <logicAppName>) to populate logicAppResourceId.
To enable the security alert to trigger the Logic App, the automation action includes a callback URL to the Logic App's manual trigger. In ARM, this is retrieved with listCallbackURL() against the trigger resource ID, which must also use the Microsoft.Logic provider, i.e., resourceId(<subscriptionId>,
<resourceGroupName>, 'Microsoft.Logic/workflows/triggers', <logicAppName>, 'manual'), with the Logic Apps API version such as 2019-05-01. This is the documented pattern for Security Center workflow automations: define an automation under Microsoft.Security/automations, specify an action of type LogicApp, reference the workflow by Microsoft.Logic, and obtain the manual trigger callback via listCallbackURL on Microsoft.Logic/workflows/triggers. This wiring ensures that when the specified security alerts are received, the automation invokes the Logic App for automatic remediation on each match.

Explanation:

When configuring suppression rules in Microsoft Defender for Cloud (previously Azure Security Center), you define the specific entity type and field values to suppress recurring or expected alerts. In this scenario, you want to hide Azure Defender alerts for a specific Azure Storage account that is being accessed during application development.
In Defender for Cloud, each protected asset (such as a virtual machine, SQL database, or storage account) is represented as an Azure Resource. Therefore, to suppress alerts for that storage account, you must target the Azure Resource entity type.
The unique identifier used to target an exact Azure resource in suppression conditions is its Resource Id, which follows the format:
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProvider}/
{resourceName}
By specifying Entity type = Azure Resource and Field = Resource Id, the suppression rule ensures that only alerts generated from that specific storage account are hidden.
Other entity types such as IP address, Host, or User account do not apply to Azure Storage alerts. Likewise, fields like Address, Command line, or Name are not used for resource-based suppression.
# Final answer:
* Entity type: Azure Resource
* Field: Resource Id

According to Microsoft Security Operations (SecOps) and Azure Sentinel documentation, when you need to create an analytics rule that executes a custom KQL query and automatically initiates a playbook, the correct configuration is to create a Scheduled rule and ensure the playbook includes a trigger.
Here's why:
* A Scheduled analytics rule in Microsoft Sentinel (Microsoft Defender XDR portal) is designed for running custom KQL queries at defined intervals (for example, every hour or every few minutes) to detect specific patterns of suspicious activity. When the rule's conditions are met, Sentinel generates alerts that can automatically trigger a playbook for response and automation.
* A playbook in Sentinel is an Azure Logic App that automates responses to incidents or alerts. To connect a playbook to an analytics rule, it must include a trigger-specifically, the "Microsoft Sentinel Alert" or "Incident trigger." This allows the rule to start the playbook automatically when the defined condition is met.
The other options are incorrect because:
* Fusion rules are built-in and use Microsoft's machine learning to correlate signals automatically; they can't be used for custom queries.
* Microsoft incident creation rules are also built-in and handle alert-to-incident grouping logic, not custom query execution.
* A service principal would be needed for permissions (e.g., admin1 configuring playbooks), but not inside the playbook itself.
* Diagnostics settings apply to log collection and retention, not rule automation.
Therefore, based on Microsoft Sentinel best practices and documentation:
# Create the rule of type: Scheduled
# Configure the playbook to include: A trigger

According to Microsoft Defender for Cloud documentation, continuous export allows you to stream security alerts and recommendations to other monitoring or SIEM systems. When exporting alerts in real time, Azure Event Hubs is the supported mechanism. Event Hubs provides a scalable data-streaming platform that can feed events into third-party SIEM tools such as Splunk, IBM QRadar, or ArcSight. Microsoft states: "To enable real-time streaming of security alerts or recommendations, configure Continuous Export to Azure Event Hubs. From there, your external SIEM or event processing solution can consume the data." The other options serve different purposes:
* Azure Cosmos DB is a NoSQL database, not used for alert streaming.
* Azure Event Grid is for reactive event-driven automation but not intended for continuous log export.
* Azure Data Lake is for large-scale storage and analytics, not streaming.
Thus, exporting Defender alerts to Azure Event Hubs is the correct and supported configuration for continuous export to third-party SIEM solutions.