In Microsoft Sentinel, to automatically generate incidents when a specific pattern or behavior is detected by a query, you must create a scheduled analytics rule.
A scheduled query rule:
* Runs a KQL query on a defined schedule (e.g., every hour).
* Triggers an alert and incident when the query returns results.
* Can map detections to MITRE ATT&CK tactics and techniques, aligning with the requirement for attack vector mapping.
Other options explained:
* Fusion rule - Uses built-in machine learning for correlation, not custom KQL logic.
* Query bookmark - Saves hunting results but does not trigger incidents.
* Hunting livestream session - Used for live monitoring, not alert generation.
# Correct answer: C. a scheduled query rule