Creating a scheduled query rule from a hunting query so detections generate incidents

Configure detections
Answer Correct answer: C — A scheduled query rule runs the detection on a schedule and creates an incident when the attack vector is found.

You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1. You create a hunting query that detects a new attack vector. The attack vector maps to a tactic listed in the MITRE ATT&CK database. You need to ensure that an incident is created in WS1 when the new attack vector is detected. What should you configure?

  1. a hunting livestream session
  2. a query bookmark
  3. a scheduled query rule Correct Answer
  4. a Fusion rule
sentinel scheduled query rule hunting query to incident analytics rule incident

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

A scheduled query (analytics) rule is the mechanism that turns a detection query into recurring automated incidents; hunting livestreams and bookmarks are investigative aids that do not by themselves generate incidents.

After a hunting query finds a new MITRE-mapped attack vector, convert it into a scheduled query rule so it runs on a schedule and automatically creates a Microsoft Sentinel incident whenever the vector is detected.

Using a hunting livestream or a bookmark — those help analysts hunt and save findings but do not create incidents automatically when the query matches.

Community Discussion (3 comments)

sapphire 👍 1 Selected: C
correct answer
12369b6 👍 1
C. Scheduled Query Rules in Microsoft Sentinel allow you to automate the detection of threats by running predefined Kusto queries at regular intervals. These rules can be customized to match specific attack vectors, such as the one you identified with your hunting query. Once the query detects suspicious activity, it can trigger an alert, which can then be configured to automatically create an incident in Sentinel
90158a0 👍 4 Selected: C
C. a scheduled query rule: This is used to run queries on a schedule, and when a match is found, it can create an incident in Microsoft Sentinel. Given that you have a hunting query that detects a new attack vector, setting up a scheduled query rule will ensure that this query runs regularly and automatically generates an incident whenever the attack vector is detected.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

To have Microsoft Sentinel automatically create an incident when a detection fires, you configure a scheduled query rule (a type of analytics rule) that runs the KQL on a schedule and generates an incident on match. The hunting query you built becomes the basis of that rule.

Why the Other Options Are Wrong

A hunting livestream session (A) is a live, session-scoped query feed and does not create incidents. A query bookmark (B) saves specific results for later investigation, not incidents. A Fusion rule (D) is a specific ML correlation rule and is not how you operationalize an arbitrary custom hunting query.

Community Comment Notes

The community is unanimous (C 100). 90158a0 and 12369b6 explain that scheduled query rules run KQL at intervals and can auto-create incidents, which is exactly the requirement.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

You have 500 on-premises Windows 11 devices that use Microso

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide