You have a custom Microsoft Sentinel workbook named Workbooks.

In Microsoft Sentinel workbooks , when displaying query results in a grid visualization , you can limit the number of displayed rows by using KQL query operators. The take operator in Kusto Query Language (KQL) is specifically designed to restrict output to a fixed number of records.

Microsoft Sentinel workbook guidance states:

“To control the number of results returned in a workbook grid, use the KQL take operator. For example, adding | take 100 ensures that only 1 00 rows are returned and displayed.”

This approach enforces both performance efficiency and readability, ensuring large result sets don’t overload the visualization.

Other options are incorrect:

Settings and Advanced Editor adjust workbook configuration, not query limits.

Project only selects specific columns, not row count.

✅ Correct answer: D. In the grid query, include the take operator