Automation Rule Trigger on Incident Creation
A security operations team uses Microsoft Sentinel. They create a playbook that changes the severity of an incident from 'Medium' to 'High' when a specific indicator of compromise (IOC) is detected within the incident's entities. The team wants this playbook to run automatically as soon as the incident is created, without manual intervention. Which type of automation rule trigger should they configure to invoke the playbook?
Quick Answer
The answer is the "When incident is created" trigger. This is correct because Microsoft Sentinel automation rules evaluate conditions and invoke playbooks at specific trigger points, and the "When incident is created" trigger fires immediately upon incident generation without requiring any manual action, perfectly matching the requirement for the playbook to run automatically to change severity based on an IOC detected in the incident's entities. On the AZ-500 exam, this concept tests your understanding of automation rule triggers versus playbook triggers; a common trap is confusing the "When incident is created" trigger with the "When alert is created" trigger, which fires earlier at the alert level before an incident is formed. Remember the memory tip: "Incident creation is the starting line—if you need to act the moment the race begins, use the 'When incident is created' trigger."
⚠ Common exam trap
Many candidates confuse 'When alert is created' with incident creation, not realizing that incidents are higher-level constructs that can aggregate multiple alerts, and the playbook must run at the incident scope to change severity based on entities across all alerts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
When incident is created
The 'When incident is created' trigger in Microsoft Sentinel automation rules is designed to invoke a playbook immediately upon incident generation, without requiring any manual action. This matches the requirement for automatic execution as soon as the incident is created, allowing the playbook to evaluate entities and change severity from 'Medium' to 'High' based on the IOC detection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
When incident is created
Why this is correct
The 'When incident is created' trigger fires the moment Microsoft Sentinel generates an incident, so the playbook executes with no analyst action. This satisfies the requirement for automatic severity escalation on IOC detection, unlike manual or entity-based triggers.
- ✗
When incident is updated
Why it's wrong here
An update trigger fires only when the incident is modified, so it cannot invoke the playbook at creation. It is tempting because update triggers suit enrichment or severity changes after triage, but the requirement is immediate execution on incident creation.
- ✗
When alert is created
Why it's wrong here
Alert-created triggers fire on alerts, not incidents, so the playbook would run before the incident and its entities exist. Incident-created triggers are required to act on incident entities; alert triggers suit alert-centric enrichment or triage workflows.
- ✗
On a time schedule
Why it's wrong here
A scheduled trigger runs at fixed intervals, so the playbook would not execute as soon as the incident is created. Schedules suit recurring tasks such as periodic IOC ingestion or reporting, not event-driven invocation on incident creation.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security team uses Microsoft Sentinel. They create a scheduled analytics rule that queries Azure Activity Logs to detect virtual machines deployed in non-approved regions. The rule generates an incident. The team wants the incident to be automatically assigned to the 'Infrastructure' team and its severity set to 'High' when it is created. Which automation feature should they use?
hard- ✓ A.Create an automation rule with trigger 'When incident is created' and actions to assign the incident to an owner and set severity
- B.Create a playbook triggered by alert creation that performs the assignment and severity change
- C.Use an automation rule with trigger 'When incident is updated' and condition on alert type
- D.Configure the analytics rule directly to set severity and owner
Why A: Automation rules in Microsoft Sentinel allow you to define triggers such as 'When incident is created' and then perform actions like assigning the incident to an owner and setting its severity. This is the native, no-code way to automate incident management without requiring a playbook or modifying the analytics rule itself.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.