What is a possible cause of the issue?

You have a custom analytics rule to detect threats in Azure Sentinel.

You discover that the analytics rule stopped running. The rule was disabled, and the rule name has a prefix of AUTO DISABLED.

What is a possible cause of the issue?
A . There are connectivity issues between the data sources and Log Analytics.
B . The number of alerts exceeded 10,000 within two minutes.
C . The rule query takes too long to run and times out.
D . Permissions to one of the data sources of the rule query were modified.

View Answer

Answer: D

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom