A livestream in Microsoft Sentinel is used for real-time query monitoring , allowing analysts to see new events that match a query as they occur. However, a livestream does not create alerts or incidents automatically .
To generate an incident when a specific condition (like a sign-in from a malicious IP address) occurs, you must create a scheduled analytics rule that runs a KQL query on a defined interval (e.g., every 5 or 10 minutes) and triggers an alert when matches are found.
Microsoft documentation clarifies:
"Livestream is an analyst tool for hunting in real time. It does not generate alerts or incidents. To generate incidents automatically, create an analytics rule using a scheduled query." Therefore, creating a livestream does not meet the requirement to automatically create incidents.
# Correct answer: B. No