Automation Rule Trigger on Incident Creation
A security operations team uses Microsoft Sentinel. They create a playbook that changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is detected within the incident's entities. The team wants this playbook to run automatically as soon as the incident is created, without manual intervention. Which type of automation rule trigger should they configure to invoke the playbook?
Quick Answer
The answer is the "When incident is created" trigger. This is correct because Microsoft Sentinel automation rules evaluate conditions and invoke playbooks at specific trigger points, and the "When incident is created" trigger fires immediately upon incident generation without requiring any manual action, perfectly matching the requirement for the playbook to run automatically to change severity based on an IOC detected in the incident's entities. On the AZ-500 exam, this concept tests your understanding of automation rule triggers versus playbook triggers; a common trap is confusing the "When incident is created" trigger with the "When alert is created" trigger, which fires earlier at the alert level before an incident is formed. Remember the memory tip: "Incident creation is the starting line—if you need to act the moment the race begins, use the 'When incident is created' trigger."
⚠ Common exam trap
Many candidates confuse 'When alert is created' with incident creation, not realizing that incidents are higher-level constructs that can aggregate multiple alerts, and the playbook must run at the incident scope to change severity based on entities across all alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
When incident is created
The 'When incident is created' trigger in Microsoft Sentinel automation rules is designed to invoke a playbook immediately upon incident generation, without requiring any manual action. This matches the requirement for automatic execution as soon as the incident is created, allowing the playbook to evaluate entities and change severity from 'Medium' to 'High' based on the IOC detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
When incident is created
Why this is correct
This trigger runs the automation rule immediately when a new incident is generated. The rule can check conditions and then run the playbook to change the severity.
- ✗
When incident is updated
Why it's wrong here
This trigger runs on changes to an existing incident, such as a status change or comment addition. It would not fire at the moment of incident creation.
- ✗
When alert is created
Why it's wrong here
Alert creation triggers run before an incident is created. While a playbook could create an incident, the requirement is for the playbook to run after the incident is created to change its severity.
- ✗
On a time schedule
Why it's wrong here
Time-based triggers run at scheduled intervals, not immediately upon incident creation. They would not meet the requirement for real-time automation.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team uses Microsoft Sentinel. They create a scheduled analytics rule that queries Azure Activity Logs to detect virtual machines deployed in non-approved regions. The rule generates an incident. The team wants the incident to be automatically assigned to the 'Infrastructure' team and its severity set to 'High' when it is created. Which automation feature should they use?
hard- ✓ A.Create an automation rule with trigger 'When incident is created' and actions to assign the incident to an owner and set severity
- B.Create a playbook triggered by alert creation that performs the assignment and severity change
- C.Use an automation rule with trigger 'When incident is updated' and condition on alert type
- D.Configure the analytics rule directly to set severity and owner
Why A: Automation rules in Microsoft Sentinel allow you to define triggers such as 'When incident is created' and then perform actions like assigning the incident to an owner and setting its severity. This is the native, no-code way to automate incident management without requiring a playbook or modifying the analytics rule itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.