Does a hunting query auto-assign new Sentinel incidents to Tier 1?
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft Sentinel workspace. You have a multi-tier Security Operations Center (SOC) team. You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage. Solution: You create a hunting query. Does this meet the goal?
Community Insight
The question tests whether you can distinguish a Sentinel hunting query from an automation rule; the trap is assuming that because a hunting query can run on a schedule it can also assign owners or tags to incidents.
Microsoft Sentinel hunting queries are proactive, analyst-driven searches over raw logs and cannot assign ownership or add triage tags to new incidents. This page establishes that an automation rule triggered on incident creation is what satisfies the stated SOC goal.
Answering Yes because hunting queries can be scheduled or because they sound like automated incident handling; in reality they only surface suspicious activity for analysts and never create, assign, or tag incidents.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A hunting query in Microsoft Sentinel is a saved KQL search that an analyst runs manually (or on a schedule) to proactively look for suspicious activity in raw log data. It does not subscribe to incident-creation events, so it has no mechanism to assign an owner or apply a tag. The requirement is event-driven: every new incident must immediately be owned by the Tier 1 analysts group and flagged for triage. That behavior belongs to a Sentinel automation rule with the trigger When incident is created, an action to assign the owner to the Tier 1 group, and an action to add a tag such as "Triage." Because a hunting query cannot perform any of those actions, the proposed solution fails and the answer is No.Why the Other Options Are Wrong
Answering Yes (option A) wrongly treats hunting as an incident-response automation capability. Even a scheduled hunting query only produces results in the hunting/logs experience; it never creates or modifies an incident record, so assignment and tagging are impossible. The confusion usually comes from mixing up three distinct Sentinel features: analytics rules create incidents from detections, hunting queries support proactive investigation, and automation rules react to incidents by assigning, tagging, or changing status. Only the automation rule matches the goal described for the multi-tier SOC.Community Comment Notes
Both commenters independently selected B. As Greens explained, hunting queries are for proactive manual threat searching and "They don’t act on incidents and can’t assign or tag anything," recommending instead an automation rule whose trigger is "When incident is created" with actions to assign the Tier 1 analysts group and add a "Triage" tag. Eltooth reinforced the same point, describing a hunting query as a manual or schedule-guided search used to discover undetected threats rather than an automation or event-driven workflow engine. That community reasoning aligns with the Sentinel feature model and confirms the answer.Official Reference
Exam Strategy
When a scenario asks for automatic ownership, tagging, or status changes on new incidents, immediately look for an automation rule trigger such as "When incident is created." If the proposed solution is a hunting query, an analytics rule alone, or a workbook, it cannot satisfy the requirement and the answer is No.
Frequently Asked Questions
Why can't a hunting query assign new Sentinel incidents to the Tier 1 analysts group?
Hunting queries only run KQL searches over log data for proactive investigation; they do not create or modify incident records, so they cannot set an owner or add a triage tag.
What Sentinel feature should I use to assign and tag every new incident automatically?
Create an automation rule triggered by "When incident is created" that assigns the owner to the Tier 1 analysts group and adds a triage tag or changes the status.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →