Microsoft Sentinel Automation Rule Severity Condition
Exhibit
Refer to the exhibit.
```json
{
"properties": {
"displayName": "Isolate Compromised Device",
"trigger": {
"type": "SecurityIncident",
"conditions": [
{
"property": "IncidentSeverity",
"operator": "Equals",
"value": "High"
},
{
"property": "AlertTitle",
"operator": "ContainsAny",
"value": ["Malware", "Ransomware"]
}
]
},
"actions": [
{
"type": "RunPlaybook",
"playbookId": "<playbook-id>"
}
]
}
}
```Refer to the exhibit. You have created an automation rule in Microsoft Sentinel with the above configuration. The playbook isolates the device and disables the user account. After enabling the rule, you notice that a low-severity incident containing an alert titled 'Ransomware Behavior' did NOT trigger the automation. What is the most likely reason?
Quick Answer
The answer is that the automation rule severity condition is not triggering because the rule is configured to trigger only on incidents with a severity of High, while the incident in question has a Low severity. This is a fundamental aspect of how Microsoft Sentinel automation rules evaluate conditions: the severity condition uses an exact match operator, so any incident not meeting the specified severity level is automatically excluded from triggering the playbook. On the SC-200 exam, this scenario tests your understanding of how trigger conditions work in combination with incident properties, and a common trap is assuming that a broader severity range or a "greater than" logic applies when it does not. Remember that automation rules evaluate each condition independently and require an exact match for severity unless you explicitly configure multiple conditions or use a different operator. A helpful memory tip is "severity is a gate, not a filter"—if the severity doesn't match exactly, the rule won't even look at other conditions like alert titles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The incident severity is Low, but the rule only triggers on High severity
The automation rule's trigger condition includes a requirement that incident severity equals High. Since the incident had Low severity, it did not meet the condition and therefore did not trigger the playbook. Option A is incorrect because the 'ContainsAny' operator can match a single value; it is not limited to multiple values. Option B is incorrect because the automation rule uses the playbook's permissions, and there is no separate permission requirement for the rule itself beyond the playbook's configured permissions. Option C is incorrect because there is no indication that the playbook ID is invalid; the rule would still attempt to run even if the ID were invalid, but the issue is the severity condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'ContainsAny' operator does not match single values
Why it's wrong here
'ContainsAny' matches if the alert title contains any of the listed strings; it works with a single match.
- ✗
The automation rule does not have permission to run the playbook
Why it's wrong here
Permissions are checked at rule creation; if invalid, the rule would not be created.
- ✗
The playbook ID is invalid
Why it's wrong here
If the playbook ID were invalid, the automation rule would show an error, not silently fail.
- ✓
The incident severity is Low, but the rule only triggers on High severity
Why this is correct
The condition requires severity equals High, so low-severity incidents are not processed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-200 question from scratch — 673 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An automation rule is configured as shown. When will the playbook be triggered?
medium- A.When any incident is created from Microsoft Defender for Endpoint
- B.When a new incident with any severity contains 'Malware' in the title
- C.When an incident is updated to High severity
- ✓ D.When a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title
Why D: The automation rule triggers on incident creation (trigger: 'When incident is created') with three conditions: Provider equals Microsoft Defender for Endpoint, Severity equals High, and Title contains 'Malware'. All conditions must be met. Therefore, the playbook triggers only when a new incident is created with severity High, from Microsoft Defender for Endpoint, and with 'Malware' in the title. Option D is correct. Option A is incorrect because the incident must also have High severity and 'Malware' in the title. Option B is incorrect because severity must be High, not any. Option C is incorrect because the trigger is on creation, not update.
Variation 2. Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. What will happen when a new incident with severity Medium is created?
hard- ✓ A.The rule will not trigger because severity is Medium
- B.The rule will trigger and create a new incident
- C.The rule will trigger and run the playbook
- D.The rule will update the incident severity to High
- E.The rule will trigger but skip the playbook
Why A: The automation rule is configured with a condition that triggers only when the incident severity is 'High'. Since the new incident has a severity of 'Medium', the condition is not met, and the rule does not trigger. Automation rules in Microsoft Sentinel evaluate conditions based on the incident's properties at creation time; if the condition fails, no actions (including playbook execution or incident creation) occur.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.