Question
You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux.
You need to use Azure Monitor to design an alerting strategy for security-related events.
Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Explanation
Events from the Windows event logs (System, Application, Security via the agent) are collected into the Event table in Azure Monitor Logs, so Windows security-related alerts query Event. Linux system logging events are collected through the syslog daemon into the Syslog table. AzureActivity holds subscription-level control-plane operations and AzureDiagnostics holds Azure resource logs, so neither stores guest OS events.
