An organization wants to implement automated threat hunting for AI systems using Microsoft Sentinel. The security team wants to schedule hunting queries to run weekly and automatically create incidents when the query returns results indicating potential AI model abuse. Which Microsoft Sentinel feature converts a hunting query into scheduled incident creation?
Select an answer to reveal the explanation.
Short Explanation
You want to convert the hunting query into a Scheduled analytics rule with incident creation enabled. That's how Sentinel turns an ad-hoc query into a recurring weekly detection that opens incidents when results come back.
Full Explanation
The correct approach is converting the hunting query to a Scheduled analytics rule with incident creation settings enabled. Microsoft Sentinel hunting queries can be promoted to Scheduled analytics rules, which run on a defined schedule, such as weekly, and automatically create incidents when results are returned. This is the primary mechanism for converting ad-hoc hunting queries into production detections. The Livestream feature is incorrect because Sentinel Livestream provides real-time query result streaming for interactive threat hunting sessions; it is not for automated weekly scheduled execution with incident creation. The Automation Rule option is incorrect because Automation Rules in Sentinel process incidents after they are created, adding tags, assigning owners, or running playbooks; they do not execute hunting queries. The Playbook with a recurrence trigger option is incorrect because a Playbook with a recurrence trigger could run a KQL query via the Log Analytics connector, but this is a complex workaround compared to the purpose-built Scheduled analytics rule feature.