A county uses Sentinel automation rules to enrich incidents with the CMDB owner for each VM. What IR enrichment pattern is that?

Using Sentinel automation rules to enrich incidents with the CMDB owner for each VM is an IR enrichment pattern that attaches civic asset-ownership context at incident creation or update. When a county VM fires an alert, analysts immediately see who owns the workload—courts, public works, elections—without manual CMDB lookups. Faster owner identification shortens containment coordination, improves notification accuracy, and reduces time lost to 'who runs this?' chat threads during active incidents.

Automating Sentinel enrichment with threat-intelligence data such as malicious IPs adds known-malicious IOC context for detection and triage prioritization, not civic asset-ownership context, so it does not stamp the CMDB owner at incident creation or update and leaves analysts without workload ownership for coordination. Automating Sentinel enrichment with identity-risk data such as anomalous sign-in events adds user and sign-in risk context about potentially compromised accounts, not civic asset-ownership context, so it does not identify which department owns the VM or who to notify for containment. Automating Sentinel enrichment with endpoint-health data such as Defender device tags adds device posture and health context, not civic asset-ownership context, so it does not automatically stamp the CMDB owner on the incident and analysts still lack owner visibility at triage without extra lookup.

Exam caveat: Enrichment quality depends on CMDB accuracy and a stable join key (Azure resource ID, hostname, subscription tags). Automation that stamps stale owners can mislead; include a feedback loop to fix CMDB when enrichment is wrong. Distinguish automation-rule enrichment with civic asset-ownership data such as CMDB owners from automating enrichment with threat-intelligence data such as malicious IPs, identity-risk data such as anomalous sign-in events, or endpoint-health data such as Defender device tags.

Operational check: Build a Sentinel automation rule or playbook that queries CMDB/ITSM by Azure resource ID or tag; create a test incident on a labeled VM and confirm the owner field populates; measure analyst time saved; and alert on enrichment failures so missing CMDB records are fixed rather than silently skipped.