Sentinel must turn matching suspicious-event patterns into actionable security detections. Which capability should be configured?

1. A VM disk resize
2. Analytics rules
3. A storage access tier alone
4. A file extension rename