Your security operations team hunts in Microsoft Sentinel mainly through the portal Logs blade, but an analyst needs to enrich a list of suspicious IP addresses against several external threat intelligence providers, geolocate them, plot the results on an interactive map, and keep the whole repeatable analysis under version control. The team wants a hunting surface that supports this without exporting data to a separate tool. Which capability in Microsoft Sentinel best meets the requirement?
- AA scheduled analytics rule that runs the enrichment Kusto Query Language (KQL) logic on a recurring interval and raises an incident, so the geolocated and threat-intelligence-enriched output is produced automatically for the analysts.
- BA Microsoft Sentinel workbook built from the visualisation gallery, which binds tiles to KQL queries so the suspicious addresses are geolocated, enriched against the threat intelligence providers, and displayed on an interactive map for the hunters.
- CA playbook based on a Logic App, triggered manually against the address list, which orchestrates connectors to the threat intelligence services and geolocation lookups and returns an interactive enriched map to the analyst team.
- DA Jupyter Notebook in Microsoft Sentinel using MSTICPy, which runs Python alongside KQL to query the workspace, call external threat intelligence and geolocation providers, render interactive visualisations, and be saved as a versioned artefact. Correct
Why A is wrong: A scheduled analytics rule runs KQL to detect and create incidents on a cadence, which is useful for alerting, but it cannot call multiple external threat intelligence APIs, render interactive maps, or hold a version-controlled iterative analysis, so it does not meet the hunting requirement.
Why B is wrong: A workbook renders dashboards from KQL over workspace data and is good for monitoring, but it cannot execute arbitrary Python, call several external TI provider APIs, or be managed as a versioned analytical script, so it falls short of the stated needs.
Why C is wrong: A playbook automates response actions through Logic App connectors and can enrich entities, but it produces no interactive notebook surface, no inline maps for exploratory analysis, and no version-controlled iterative hunt, so it does not fit free-form threat hunting.
Why D is correct: Notebooks bring a full Python runtime with the MSTICPy library, letting an analyst query Sentinel, enrich indicators against multiple TI and geolocation providers, plot interactive maps, and store the notebook in source control as a repeatable hunt, which is exactly what the requirement describes.