Microsoft Azure Security Engineer Associate AZ-500 Practice Question

In Microsoft Sentinel, every analytics rule-whether created from scratch or generated from a built-in template-is represented in Azure Resource Manager as a resource of type Microsoft.SecurityInsights/alertRules. Deploying this resource type with the required properties (such as query, scheduling, tactics, severity, and Enabled set to true) creates or updates the rule and allows it to begin generating incidents.

Microsoft.OperationalInsights/savedSearches defines Kusto queries only and does not create incidents. Microsoft.Insights/scheduledQueryRules is used by Azure Monitor alerting, not by Microsoft Sentinel. Microsoft.SecurityInsights/automationRules represents playbook-like response logic applied after incidents are created and cannot stand in for analytics rules themselves.