Microsoft Azure Security Technologies AZ-500 — Question 36

Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled. You have been tasked with analyzing the security events of a Windows Server 2016 virtual machine. You have already accessed Azure Monitor. Which of the following options should you use?