AZ-500 Question 270
Select 2You have created a custom analytics rule in Microsoft Sentinel to detect suspicious sign-ins originating from multiple countries in a short time window. After configuring the necessary data connectors and verifying that logs are flowing into your workspace, you notice that the analytics rule is not generating any alerts or incidents. Upon further inspection, you discover that the rule is disabled. Which two actions must you take to properly enable the rule and ensure it creates incidents in Microsoft Sentinel?
- A
Toggle the rule's status to 'Enabled' in the rule configuration.
- B
Change the rule type from 'Scheduled' to 'Streaming' for real-time detection.
- C
Enable the 'Create incidents' setting within the rule's incident configuration.
- D
Tag the rule with an appropriate MITRE ATT&CK tactic before enabling it.
Show answer and explanation
Correct answers: A, C
Explanation
To properly enable an analytics rule and have it generate incidents, you must ensure the rule's status is toggled to 'Enabled' and that 'Create incidents' is turned on in the incident settings. According to Microsoft Sentinel documentation, a disabled rule will never run or produce alerts, and disabling the 'Create incidents' option means no incidents will be generated even if the rule detects suspicious activity. Refer to Microsoft Sentinel's official documentation at https://learn.microsoft.com/azure/sentinel/ for further details on configuring and enabling analytics rules.
- A. Correct.
Option 1 is correct. Simply having a rule in place does not make it active; you must explicitly enable it. When the rule is disabled, no detections or incidents will be generated.
- B. Incorrect.
Option 2 is incorrect. Changing the rule from 'Scheduled' to 'Streaming' is not necessary for generating incidents. 'Scheduled' rules can still trigger alerts and incidents as long as they are enabled and properly configured.
- C. Correct.
Option 3 is correct. Even if a rule is enabled, it must be configured to create incidents in the rule's incident settings. Without this setting turned on, no incidents will be generated.
- D. Incorrect.
Option 4 is incorrect. While mapping tactics to MITRE ATT&CK can enhance rule context and alignment with industry frameworks, it is not a mandatory step for enabling a rule or ensuring it creates incidents.