Explanation:
Select Take action.
Configure the Trigger automated response settings.
Filter by alert title.
In Microsoft Defender for Cloud, automatic responses to alerts are implemented through Take action # Trigger automated response , which creates or binds a workflow automation to a Logic App. For an alert such as "Suspicious process executed" , the least-effort approach is to start from the alert experience and attach the prebuilt Logic App that uses the "When a Defender for Cloud alert is created or triggered" trigger (your LogicApp2 ). The documented flow is: open the alert and choose Take action ; within that blade, select Trigger automated response to connect a Logic App; then scope the automation by setting conditions/filters , including Alert title , so it only runs when the specific alert ("Suspicious process executed") is generated. This maps exactly to the three steps above.
Other panes under Take action - Mitigate the threat and Prevent future attacks -provide manual guidance or recommend hardening steps and are not used to bind a Logic App. Similarly, Suppress similar alerts is for tuning noise, not for launching automations. Because you already have LogicApp2 with the Defender for Cloud alert trigger, selecting Trigger automated response and filtering by alert title ensures the playbook runs every time that specific alert fires , with minimal administration and without creating additional custom logic.