You are hunting in Microsoft Defender XDR for a single multi-stage intrusion where a compromised domain account first authenticated against on-premises domain controllers and then a process was launched on an onboarded workstation under that same account. Your Kusto Query Language (KQL) query must read both the on-premises Active Directory authentication events that Microsoft Defender for Identity collects and the process creation events with full command lines on the endpoint, so the two stages can be joined on the account and correlated into one chain. Which TWO Advanced Hunting tables must the query read to obtain both stages? Select TWO.
- AIdentityLogonEvents, because it records the on-premises Active Directory authentication and logon activity that Microsoft Defender for Identity collects from domain controllers, including the account, the logon type, and the source and destination devices. Correct
- BDeviceProcessEvents, because it records process creation on onboarded devices with the full command line and the initiating parent process, which is the endpoint execution stage that must be matched to the authenticating account. Correct
- CDeviceLogonEvents, because it records the on-premises Active Directory authentication events that Microsoft Defender for Identity collects from domain controllers, including the account and the source and destination devices for each domain logon.
- DDeviceNetworkEvents, because it records the process creation and command-line activity on onboarded devices, which is the endpoint execution stage that must be matched to the authenticating domain account in the chain.
Why A is correct: IdentityLogonEvents holds the domain controller authentication events surfaced by Microsoft Defender for Identity, which is exactly the on-premises identity stage the hunt needs to correlate against the endpoint process activity.
Why B is correct: DeviceProcessEvents captures process creations with command lines and parent process on the endpoint, supplying the workstation execution stage that the query joins to the authenticating account from the identity table.
Why C is wrong: DeviceLogonEvents records sign-ins observed on the endpoints themselves, not the domain controller authentications from Microsoft Defender for Identity, so it does not supply the on-premises directory stage the hunt requires.
Why D is wrong: DeviceNetworkEvents records outbound and inbound connections with remote address and port, not process creation or command lines, so it cannot provide the endpoint execution stage the requirement describes.