According to Microsoft Sentinel documentation, automation rules are used to automatically assign, tag, or close incidents as soon as they are created. Automation rules can filter incidents based on attributes such as alert name, severity, or source , and then perform specific actions like assigning incidents to users or groups .
In this scenario, incidents are generated by Rule1 from two different AD DS domains - contoso.com and fabrikam.com - and each must be routed to a specific security group for triage. The most efficient approach is to create two automation rules , each filtering incidents by domain (one for contoso.com and one for fabrikam.com) and automatically assigning them to Group1 and Group2 respectively. This approach minimizes administrative overhead because automation rules are easy to maintain and don't require the complexity of a playbook.
A playbook (Logic App) could technically achieve the same outcome, but it introduces more administrative management, permissions, and maintenance. Hence, per Microsoft Sentinel best practices, multiple automation rules provide a lightweight and direct automation layer for incident assignment.
# Correct answer: C. two automation rules assigned to Rule1