When you create a Near-Real-Time (NRT) analytics rule in Microsoft Sentinel , the rule runs every minute and triggers almost immediately when matching events are ingested. These NRT rules are designed for time- sensitive detections, such as when you need to respond quickly to activity from connectors like Azure Activity .
However, NRT rules do not generate incidents directly . Instead, they produce alerts , which can then trigger playbooks or automations via the Alert automation settings section.
* A. Incident automation settings: This applies to standard scheduled analytics rules that create incidents , not NRT rules. Since NRT rules generate alerts (not incidents), this option would not apply.
* B. Entity mapping: This is used to map data fields (like Account, Host, IP) for better investigation, but it does not control playbook execution.
* C. The query rule: The query defines what data triggers the rule, not the automation or playbook execution. The playbook is attached separately.
* D. Alert automation settings: # According to Microsoft documentation, "To automatically run a playbook when an alert is created by a near-real-time rule, configure the playbook in the Alert automation settings section." This allows the playbook to run immediately when the alert is generated, achieving near-real-time response with minimal latency.
Detailed reasoning: