Creating a scheduled query rule from a hunting query so detections generate incidents

SC-200 By islever Editorial Last updated

Configure detections

Short answer

C A scheduled query rule runs the detection on a schedule and creates an incident when the attack vector is found.

Question

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database. You need to ensure that an incident is created in WS1 when the new attack vector is detected. What should you configure?
  1. a hunting livestream session
  2. a query bookmark
  3. a scheduled query rule Correct Answer
  4. a Fusion rule

Key Takeaways

A scheduled query (analytics) rule is the mechanism that turns a detection query into recurring automated incidents; hunting livestreams and bookmarks are investigative aids that do not by themselves generate incidents.

After a hunting query finds a new MITRE-mapped attack vector, convert it into a scheduled query rule so it runs on a schedule and automatically creates a Microsoft Sentinel incident whenever the vector is detected.

Common mistake: Using a hunting livestream or a bookmark — those help analysts hunt and save findings but do not create incidents automatically when the query matches.

Expert Analysis

Why the Answer Is Correct

To have Microsoft Sentinel automatically create an incident when a detection fires, you configure a scheduled query rule (a type of analytics rule) that runs the KQL on a schedule and generates an incident on match. The hunting query you built becomes the basis of that rule.

Why the Other Options Are Wrong

A hunting livestream session (A) is a live, session-scoped query feed and does not create incidents. A query bookmark (B) saves specific results for later investigation, not incidents. A Fusion rule (D) is a specific ML correlation rule and is not how you operationalize an arbitrary custom hunting query.

Community Comment Notes

The community is unanimous (C 100). 90158a0 and 12369b6 explain that scheduled query rules run KQL at intervals and can auto-create incidents, which is exactly the requirement.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. 90158a0 👍 4 Answered C
    C. a scheduled query rule: This is used to run queries on a schedule, and when a match is found, it can create an incident in Microsoft Sentinel. Given that you have a hunting query that detects a new attack vector, setting up a scheduled query rule will ensure that this query runs regularly and automatically generates an incident whenever the attack vector is detected.
  2. 12369b6 👍 1
    C. Scheduled Query Rules in Microsoft Sentinel allow you to automate the detection of threats by running predefined Kusto queries at regular intervals. These rules can be customized to match specific attack vectors, such as the one you identified with your hunting query. Once the query detects suspicious activity, it can trigger an alert, which can then be configured to automatically create an incident in Sentinel
  3. sapphire 👍 1 Answered C
    correct answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide