Explanation:
Box 1: Automation rules
You can respond to threats by using playbooks with automation rules in Microsoft Sentinel Box 2: Incident Use triggers and actions in Microsoft Sentinel playbooks For most use cases, incident-triggered automation is the preferable approach. In Microsoft Sentinel, an incident is a "case file" ?an aggregation of all the relevant evidence for a specific investigation. It's a container for alerts, entities, comments, collaboration, and other artifacts.
Unlike alerts which are single pieces of evidence, incidents are modifiable, have the most updated status, and can be enriched with comments, tags, and bookmarks. The incident allows you to track the attack story which keeps evolving with the addition of new alerts.
For these reasons, it makes more sense to build your automation around incidents. So the most appropriate way to create playbooks is to base them on the Microsoft Sentinel incident trigger in Azure Logic Apps.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation- rules
https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook