A Microsoft Sentinel playbook must automatically isolate an Azure VM when Microsoft Defender for Endpoint detects that the VM has been used to exfiltrate data from an Azure OpenAI deployment. The playbook should trigger automatically when an incident is created. Which Sentinel feature enables automatic playbook execution?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need an automation rule that fires when the Defender for Endpoint analytics rule creates an incident, then runs the playbook to isolate the virtual machine. That's how you get hands-off response without an analyst clicking anything.
Full Explanation
An automation rule configured to run a playbook when an incident with specific analytics rule names is created is correct because Microsoft Sentinel Automation Rules allow you to define conditions, such as an incident created by a specific analytics rule, and actions, such as running a specific playbook. This fully automates the response—when the specified Defender for Endpoint analytics rule creates an incident, the automation rule immediately triggers the playbook to isolate the virtual machine without human intervention. A manual playbook trigger from the incident page is wrong because it requires an analyst to initiate it; it is not automatic. A workbook with a playbook link button is wrong because workbooks are visualization tools; a playbook link button still requires manual clicking by an analyst. A scheduled playbook trigger via Logic Apps recurrence is wrong because a Logic Apps recurrence trigger runs on a time schedule, not in response to incident creation events.