You are configuring a diagnostic setting on an Azure key vault so that its resource logs flow into your Microsoft Sentinel workspace. The setting offers several destinations. Which destination causes the key vault's resource logs to be ingested into the Log Analytics workspace that backs Microsoft Sentinel so that they are queryable with KQL?
- AArchive to a storage account, which writes the resource logs as blobs for long-term retention and exposes them to Microsoft Sentinel for interactive KQL queries.
- BSend to a Log Analytics workspace, selecting the workspace that backs Microsoft Sentinel so the key vault's resource logs are ingested into a table and queryable with KQL. Correct
- CStream to an Azure Event Hubs namespace, which forwards the resource logs to third-party tools and simultaneously lands them in the Sentinel workspace for KQL queries.
- DSend to a partner solution, which routes the resource logs through an integrated partner's pipeline and returns them to the Sentinel workspace as a queryable table.
Why A is wrong: Archiving to a storage account stores the logs as blobs for cheap retention, but Sentinel does not query a storage account interactively, so the logs would not be ingested into the workspace or available to KQL.
Why B is correct: Choosing the Log Analytics workspace destination and pointing it at the Sentinel-enabled workspace writes the key vault resource logs into a table in that workspace, which is what makes them ingested and directly queryable with KQL.
Why C is wrong: Streaming to an Event Hub is meant to hand logs off to external or third-party systems; it does not by itself write the records into the Log Analytics workspace, so the data would not be queryable in Sentinel via KQL.
Why D is wrong: The partner solution destination delivers logs to a specific integrated partner's service rather than into your Log Analytics workspace, so it does not make the key vault logs queryable with KQL inside Sentinel.