Fix Analytics Rule Not Creating Incidents
Your Microsoft Sentinel environment is not generating incidents from a custom KQL detection rule. The rule runs successfully in the Log Analytics query editor but no incidents appear. What is the most likely cause?
Quick Answer
The answer is that the rule does not have the "Create incident from alerts triggered by this rule" toggle enabled. This is the most likely cause because a custom KQL detection rule in Microsoft Sentinel can run successfully and generate alerts in Log Analytics without ever creating an incident; the analytics rule incident creation toggle specifically controls whether those alerts are promoted to incidents. On the SC-200 exam, this tests your understanding of the distinction between alert generation and incident creation—a common trap is assuming a working query automatically produces incidents. The toggle sits in the "Incident settings" tab of the analytics rule wizard, and many candidates overlook it when troubleshooting. Remember the memory tip: "Alerts are logs, incidents are cases"—if the query works but no incidents appear, always check that the incident creation switch is turned on.
⚠ Common exam trap
The trap is that candidates often assume entity mapping is necessary for incident creation, but in reality the key setting is the 'Create incident' toggle. They may overlook this simple configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The rule is set to create alerts but not incidents
The most likely cause is that the rule is set to create alerts but not incidents. In Microsoft Sentinel, analytics rules have a toggle to 'Create incidents' from alerts. If this toggle is disabled, alerts are generated but not grouped into incidents. The query running successfully in Log Analytics confirms the rule logic works, but incidents will not appear unless the incident creation toggle is enabled. Entity mapping is not required for incident creation; it enhances correlation but is not a prerequisite.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule's alert grouping settings are misconfigured
Why it's wrong here
Incorrect. Alert grouping settings affect how alerts are grouped into incidents, but if no incidents appear at all, the issue is likely that incident creation is disabled entirely.
- ✓
The rule is set to create alerts but not incidents
Why this is correct
Correct. The rule is set to create alerts but not incidents, meaning the 'Create incident' toggle is off. This is the most common reason for missing incidents despite successful query execution.
- ✗
The rule's query schedule is too long
Why it's wrong here
Incorrect. A long query schedule would delay incident creation but would still generate incidents eventually. The absence of any incidents suggests the schedule is not the issue.
- ✗
The rule does not have entity mapping configured
Why it's wrong here
Incorrect. Entity mapping is not required for incident creation. It enhances correlation but is not a prerequisite. Incidents can be created without entity mapping.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. The exhibit shows a KQL query used in a Microsoft 365 Defender custom detection rule. The query is intended to detect encoded PowerShell commands executed in the last hour. However, the detection rule is not generating any alerts even though the SOC knows that encoded PowerShell commands are being executed. Which modification would most likely fix the detection rule?
hard- A.Change `contains` to `has` for better performance and accuracy.
- ✓ B.Add a condition to also look for `-EncodedCommand` in the command line.
- C.Modify the query to use `project-away` instead of `project`.
- D.Replace `FileName == "powershell.exe"` with `InitiatingProcessFileName == "powershell.exe"`.
Why B: The query uses `contains '-e'` which is too broad and matches many non-encoded commands. Adding a condition to explicitly check for `-EncodedCommand` in the command line narrows the detection to actual encoded PowerShell commands, which is the most likely fix for false negatives. Options A, C, and D either address performance issues or irrelevant filtering that would not specifically fix the detection of encoded commands.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.