Does a hunting query auto-assign new Sentinel incidents to Tier 1?
Short answer
B No. A hunting query cannot auto-assign new incidents to the Tier 1 analysts group or tag them for triage; a Sentinel automation rule is required.
Question
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create a hunting query.
Does this meet the goal?
Key Takeaways
The question tests whether you can distinguish a Sentinel hunting query from an automation rule; the trap is assuming that because a hunting query can run on a schedule it can also assign owners or tags to incidents.
Microsoft Sentinel hunting queries are proactive, analyst-driven searches over raw logs and cannot assign ownership or add triage tags to new incidents. This page establishes that an automation rule triggered on incident creation is what satisfies the stated SOC goal.
Common mistake: Answering Yes because hunting queries can be scheduled or because they sound like automated incident handling; in reality they only surface suspicious activity for analysts and never create, assign, or tag incidents.
Expert Analysis
Why the Answer Is Correct
A hunting query in Microsoft Sentinel is a saved KQL search that an analyst runs manually (or on a schedule) to proactively look for suspicious activity in raw log data. It does not subscribe to incident-creation events, so it has no mechanism to assign an owner or apply a tag. The requirement is event-driven: every new incident must immediately be owned by the Tier 1 analysts group and flagged for triage. That behavior belongs to a Sentinel automation rule with the trigger When incident is created, an action to assign the owner to the Tier 1 group, and an action to add a tag such as "Triage." Because a hunting query cannot perform any of those actions, the proposed solution fails and the answer is No.
Why the Other Options Are Wrong
Answering Yes (option A) wrongly treats hunting as an incident-response automation capability. Even a scheduled hunting query only produces results in the hunting/logs experience; it never creates or modifies an incident record, so assignment and tagging are impossible. The confusion usually comes from mixing up three distinct Sentinel features: analytics rules create incidents from detections, hunting queries support proactive investigation, and automation rules react to incidents by assigning, tagging, or changing status. Only the automation rule matches the goal described for the multi-tier SOC.
Community Comment Notes
Both commenters independently selected B. As Greens explained, hunting queries are for proactive manual threat searching and "They don’t act on incidents and can’t assign or tag anything," recommending instead an automation rule whose trigger is "When incident is created" with actions to assign the Tier 1 analysts group and add a "Triage" tag. Eltooth reinforced the same point, describing a hunting query as a manual or schedule-guided search used to discover undetected threats rather than an automation or event-driven workflow engine. That community reasoning aligns with the Sentinel feature model and confirms the answer.
Official Reference
- https://learn.microsoft.com/en-us/azure/sentinel/hunting
- https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules
These links open the official vendor documentation in a new tab.
Exam Strategy
When a scenario asks for automatic ownership, tagging, or status changes on new incidents, immediately look for an automation rule trigger such as "When incident is created." If the proposed solution is a hunting query, an analytics rule alone, or a workbook, it cannot satisfy the requirement and the answer is No.
Frequently Asked Questions
Why can't a hunting query assign new Sentinel incidents to the Tier 1 analysts group?
What Sentinel feature should I use to assign and tag every new incident automatically?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
Greens 👍 1 Answered BHunting queries are for proactive, manual threat searching. An analyst runs them to look for suspicious activity that hasn’t triggered an alert. They don’t act on incidents and can’t assign or tag anything. What meets the goal is an automation rule: Trigger: When incident is created Actions: Assign owner → Tier 1 analysts group, and Add tags → e.g. “Triage”. You could also change the status or set the severity. Automation rules run immediately when an incident is created, which matches the “assigned immediately” requirement. For more complex logic, an automation rule can also run a playbook (Logic App), but for simple assignment and tagging the automation rule alone is enough.
-
Eltooth 👍 1 Answered BNo Hunting Query Purpose: In Microsoft Sentinel, a hunting query is a manual or schedule-guided search query used by security analysts to proactively discover undetected threats across raw logs. It is not an automation or event-driven workflow engine.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →