Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Enabling the option to create incidents immediately ensures that each match found by the analytics rule generates a new incident as soon as the query runs, instead of being batched until the next evaluation cycle. Enabling the rule in disabled mode only prevents it from running. Setting the suppression option skips creating incidents for repeated matches within the suppression window, the alert grouping threshold controls merging of alerts into a single incident, and Playbook automation adds response actions but does not control when incidents are created.