AZ-500 Question 272
Select 2Your organization uses Microsoft Sentinel to monitor security activity. A new requirement is to automatically respond to all high-severity security alerts that originate specifically from on-premises logs. The response must include sending an email notification to the security team and marking the alert as 'Acknowledged.' Which two actions should you implement to configure an automation rule that meets these requirements?
- A
Create an automation rule, select the condition for 'High' severity and the data source filter for 'On-prem logs,' and add an action to run a playbook that sends an email and updates the alert’s status.
- B
Create a new Logic App with the 'When a Microsoft Sentinel incident is created' trigger, configure email notification and update incident status in the same workflow, and reference this playbook from the automation rule.
- C
Enable the built-in 'Resolve all alerts automatically' option in the automation rule to apply the response to any alert with severity above Medium, ignoring data source constraints.
- D
Use Azure Monitor Alerts to directly trigger the Logic App whenever a high severity alert is generated in Log Analytics, bypassing Microsoft Sentinel's automation rules entirely.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirement of automatically responding to high-severity alerts from on-premises logs, you must create an automation rule in Microsoft Sentinel to filter based on those conditions and then invoke a Logic App playbook. The playbook (built using the 'When a Microsoft Sentinel incident is created' trigger) should send emails and update the alert’s status. Refer to the official Microsoft Sentinel documentation (e.g., https://learn.microsoft.com/azure/sentinel/automate-incident-handling-with-playbooks) for guidance on creating automation rules and integrating them with Logic Apps.
- A. Correct.
Correct. Configuring an automation rule in Microsoft Sentinel to filter by both severity (High) and the on-premises data source, then running the appropriate playbook to send email notifications and update the alert status, addresses the requirement exactly as stated.
- B. Correct.
Correct. Creating a Logic App with the 'When a Microsoft Sentinel incident is created' trigger allows you to define your desired actions (e.g., sending emails, updating the incident) in one workflow. Referencing this playbook from the automation rule ensures it runs only when the specified conditions (on-premises logs and High severity) are met.
- C. Incorrect.
Incorrect. While automation rules can be configured to automatically resolve certain alerts, enabling 'Resolve all alerts automatically' and applying it broadly above Medium severity ignores the specific on-premises data source filter requirement.
- D. Incorrect.
Incorrect. Using Azure Monitor Alerts to trigger a Logic App bypasses the native automation rule capabilities in Microsoft Sentinel. This would not address the need to filter and handle alerts based on Sentinel’s specific incident attributes, such as data source or severity.