You have an Azure Sentinel deployment. You need to create a scheduled query rule named Rule1. What should you use to define the query rule logic for Rule1? 

Answer options:

A. a Transact-SQL statement
B. a JSON definition
C. GraphQL
D. a Kusto query

D

Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom