Skip to content

Commit 84db9c9

Browse files
authored
Update create-manage-use-automation-rules.md
1 parent 8d07072 commit 84db9c9

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

articles/sentinel/create-manage-use-automation-rules.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ The following table shows the different possible scenarios that will cause an au
5353
| Trigger type | Events that cause the rule to run |
5454
| --------- | ------------ |
5555
| **When incident is created** | **Unified security operations platform in Microsoft Defender:**<li>A new incident is created in the Microsoft Defender portal.<br><br>**Microsoft Sentinel not onboarded to unified platform:**<li>A new incident is created by an analytics rule.<li>An incident is ingested from Microsoft Defender XDR.<li>A new incident is created manually. |
56-
| **When incident is updated**<br> | <li>An incident's status is changed (closed/reopened/triaged).<li>An incident's owner is assigned or changed.<li>An incident's severity is raised or lowered.<li>Alerts are added to an incident.<li>Comments, tags, or tactics are added to an incident. |
57-
| **When alert is created**<br> | <li>An alert is created by a Microsoft Sentinel **Scheduled** or **NRT** analytics rule. |
56+
| **When incident is updated** | <li>An incident's status is changed (closed/reopened/triaged).<li>An incident's owner is assigned or changed.<li>An incident's severity is raised or lowered.<li>Alerts are added to an incident.<li>Comments, tags, or tactics are added to an incident. |
57+
| **When alert is created** | <li>An alert is created by a Microsoft Sentinel **Scheduled** or **NRT** analytics rule. |
5858

5959
## Create your automation rule
6060

0 commit comments

Comments
 (0)