An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?
Trap 1: In the Azure Policy definitions
Azure Policy is for compliance, not incident response logic.
Trap 2: In the Sentinel Data Connector configuration
Data connectors are for ingestion, not response logic.
Trap 3: Inside the KQL query of the analytic rule
While possible, the best practice for playbook-specific logic is in the Automation Rule to keep analytic rules clean.
- A
In the Azure Policy definitions
Why wrong: Azure Policy is for compliance, not incident response logic.
- B
In the Sentinel Data Connector configuration
Why wrong: Data connectors are for ingestion, not response logic.
- C
Inside the KQL query of the analytic rule
Why wrong: While possible, the best practice for playbook-specific logic is in the Automation Rule to keep analytic rules clean.
- D
In the Automation Rule trigger condition
Automation rules allow filtering by alert severity and entity values before triggering the playbook.