What Actions Can Automation Rules Perform in Microsoft Sentinel?
Which THREE actions can be performed by automation rules in Microsoft Sentinel?
Quick Answer
The answer is that automation rules in Microsoft Sentinel can perform actions including adding a tag to an incident, assigning incidents to an owner, and running a playbook. These actions are correct because automation rules are designed to streamline incident response by automatically applying predefined workflows based on triggers like incident creation or update, allowing analysts to focus on investigation rather than manual triage. On the SC-200 exam, this topic tests your understanding of how automation rules differ from analytics rules and playbooks, often appearing in multiple-choice questions where a common trap is confusing run playbook with run a query or change a status. A key memory tip is to remember the three core actions as TAP: Tag, Assign, and Playbook, which covers the only incident-level modifications automation rules can directly apply without requiring a Logic App.
⚠ Common exam trap
It's easy for candidates to confuse automation rules with analytics rules or data connectors, assuming automation rules can modify data sources or create detection logic, when in fact automation rules are limited to post-ingestion incident management actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an incident to a specific owner
Automation rules in Microsoft Sentinel can automatically assign incidents to specific owners based on conditions such as severity, entity type, or custom criteria. This action helps streamline incident response by ensuring the right personnel are notified and responsible for handling the incident without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify a data connector to ingest more logs
Why it's wrong here
Data connectors are not modified by automation rules.
- ✗
Create a new analytics rule
Why it's wrong here
Creating analytics rules is not an automation rule action.
- ✓
Assign an incident to a specific owner
Why this is correct
Automation rules have an 'Assign owner' action.
- ✓
Run a playbook on an incident
Why this is correct
Automation rules can trigger playbooks.
- ✓
Add a tag to an incident
Why this is correct
Automation rules can add tags.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions are valid for automation rules in Microsoft Sentinel? (Choose two.)
hard- ✓ A.Change the severity of an incident.
- B.Delete an incident.
- ✓ C.Run a playbook.
- D.Add tags to an incident.
- E.Modify an existing analytics rule.
Why A: Automation rules in Microsoft Sentinel allow you to automate incident management tasks without requiring a playbook. Changing the severity of an incident is a supported action, enabling you to adjust the priority based on custom criteria such as incident properties or enrichment data.
Variation 2. Which TWO of the following are valid actions that can be performed by an automation rule in Microsoft Sentinel? (Select two.)
medium- A.Delete a watchlist
- B.Create a task
- C.Modify an analytics rule
- ✓ D.Assign incident to an analyst
- ✓ E.Run a playbook
Why D: Automation rules in Microsoft Sentinel can assign incidents to specific analysts or groups as part of incident response workflows. This action helps ensure accountability and proper triage by routing incidents to the appropriate personnel based on criteria like severity or type.
Variation 3. Which TWO actions can a Microsoft Sentinel automation rule perform when an incident is created?
easy- A.Create a new analytics rule
- B.Query Log Analytics workspaces
- ✓ C.Run a playbook
- ✓ D.Change the incident severity
- E.Ingest data from a new source
Why C: Microsoft Sentinel automation rules can trigger actions when an incident is created, including running a playbook (Option C) and changing the incident severity (Option D). Playbooks are automated workflows based on Azure Logic Apps that can perform complex response actions, while severity changes allow dynamic triage based on incident properties.
Variation 4. Which TWO actions can you perform using Microsoft Sentinel automation rules? (Select two.)
medium- ✓ A.Create a task on an incident
- ✓ B.Run a playbook on an incident
- C.Create an incident automatically
- D.Create a new automation rule
- E.Send an email notification
Why A: Microsoft Sentinel automation rules can create tasks on incidents. This allows you to automatically assign investigation steps or remediation actions to specific personnel, ensuring consistent incident response workflows.
Variation 5. Which TWO actions can you perform using Microsoft Sentinel automation rules?
medium- A.Create a new analytics rule based on an incident.
- ✓ B.Assign an incident to a specific analyst.
- C.Modify the data connector's polling interval.
- ✓ D.Run a playbook automatically when an incident is created.
- E.Automatically create an incident from a log event.
Why B: Microsoft Sentinel automation rules can directly assign an incident to a specific analyst using the 'Assign owner' action. This allows security operations teams to automatically route incidents to the appropriate personnel based on criteria such as severity, tactic, or entity, improving response efficiency.
Variation 6. Which TWO actions can you perform using Microsoft Sentinel automation rules?
medium- A.Create a new analytics rule
- B.Modify a data connector
- ✓ C.Change incident status
- ✓ D.Run a playbook
- E.Delete an incident
Why C: Automation rules in Microsoft Sentinel allow you to automatically manage incidents by changing their status (e.g., from 'New' to 'Active' or 'Closed') based on conditions like severity or title. They can also trigger playbooks (automated response workflows) when incidents are created or updated, enabling actions such as enrichment, investigation, or remediation. These capabilities are defined in the automation rule's 'Actions' section, where you set the incident status or select a playbook to run.
Variation 7. Which THREE actions can you perform using Microsoft Sentinel automation rules?
hard- A.Create a new analytics rule
- B.Add threat intelligence indicators to Sentinel
- ✓ C.Run a playbook
- ✓ D.Change the severity of an incident
- ✓ E.Assign an incident to a specific analyst
Why C: Automation rules in Microsoft Sentinel can trigger a playbook as an automated response to an incident or alert. Playbooks are based on Azure Logic Apps and allow you to run complex workflows, such as gathering additional data, sending notifications, or taking remediation actions, directly from the automation rule.
Variation 8. Which TWO actions can be performed using Microsoft Sentinel automation rules? (Select TWO.)
medium- ✓ A.Assign an incident to a specific SOC analyst
- B.Modify a data connector's configuration
- C.Create a new analytics rule
- D.Create a new watchlist
- ✓ E.Run a playbook on an incident
Why A: Automation rules in Microsoft Sentinel allow you to automate incident management tasks, such as assigning incidents to specific SOC analysts based on criteria like severity or type. This is a core capability of automation rules, which can set the owner of an incident to a specific user or group, enabling efficient triage and accountability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.