A security team uses Microsoft Sentinel. They want to automatically assign a severity level and an owner to every incident that is created from a specific analytics rule. The owner should be a specific security operations group. Which Microsoft Sentinel feature should they configure to achieve this automation?

Modify the analytics rule to include a custom script that runs upon alert generation.

Analytics rules do not directly support custom scripts for incident modification. They are for detection logic; post-processing automation is done via automation rules.

Use a Logic Apps playbook connected to the analytics rule's alert generation trigger.

A playbook can be triggered by an alert, but playbooks are better suited for complex orchestration (e.g., isolating a VM). For simple property changes like severity and owner, an automation rule is the appropriate feature.

Configure a workbook to filter and manually assign incidents.

Workbooks are for visualization and reporting, not for automation of incident properties. They do not assign owners or change severity automatically.

What does this AZ-500 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create an automation rule that triggers when an incident is created and sets the severity and owner fields. — Microsoft Sentinel uses automation rules to automate incident management tasks, such as changing the incident severity, assigning it to an owner, or running a playbook. When an incident is created (trigger: When incident is created), an automation rule can set properties like severity and owner. This is more efficient than modifying analytics rules themselves.

What should I do if I get this AZ-500 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.