Valid Actions for Microsoft Sentinel Automation Rules

• ✓ A.Change the severity of an incident.
• B.Delete an incident.
• ✓ C.Run a playbook.
• D.Add tags to an incident.
• E.Modify an existing analytics rule.

Why A: Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.

• A.Delete a watchlist
• B.Create a task
• C.Modify an analytics rule
• ✓ D.Assign incident to an analyst
• ✓ E.Run a playbook

Why D: Option D is correct because automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.

• A.Create a new analytics rule
• B.Query Log Analytics workspaces
• ✓ C.Run a playbook
• ✓ D.Change the incident severity
• E.Ingest data from a new source

Why C: Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.

• ✓ A.Create a task on an incident
• ✓ B.Run a playbook on an incident
• C.Create an incident automatically
• D.Create a new automation rule
• E.Send an email notification

Why A: Option A is correct because Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.

• A.Create a new analytics rule based on an incident.
• ✓ B.Assign an incident to a specific analyst.
• C.Modify the data connector's polling interval.
• ✓ D.Run a playbook automatically when an incident is created.
• E.Automatically create an incident from a log event.

Why B: Option B is correct because Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.

• A.Create a new analytics rule
• B.Modify a data connector
• ✓ C.Change incident status
• ✓ D.Run a playbook
• E.Delete an incident

Why C: Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.

• A.Modify a data connector to ingest more logs
• B.Create a new analytics rule
• ✓ C.Assign an incident to a specific owner
• ✓ D.Run a playbook on an incident
• ✓ E.Add a tag to an incident

Why C: Option C is correct because automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.

• ✓ A.Run a playbook
• ✓ B.Assign an incident to an owner
• C.Create an incident
• D.Modify an analytics rule
• E.Delete an incident

Why A: Option A is correct because automation rules in Microsoft Sentinel can trigger a playbook as an action when an incident is created or updated. Playbooks are automated workflows based on Azure Logic Apps, allowing for complex response actions such as threat containment, notification, or enrichment. This enables security teams to automate incident response without manual intervention.