Microsoft Security Operations Analyst Associate SC-200 Practice Question

A playbook that should run when Microsoft Sentinel creates a new incident must start with the dedicated incident trigger provided by the Microsoft Sentinel connector. The trigger named "When a response to an Azure Sentinel incident is triggered" (sometimes shown as "Microsoft Sentinel incident") is specifically designed to be called from an automation rule on incident creation. The older alert-level trigger ("When a response to an Azure Sentinel alert is triggered") only works for alert automation, and generic Logic App triggers such as "Recurrence" or "When an HTTP request is received" do not integrate with Sentinel automation rules without additional configuration.