Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Create Manage Use Automation Rules

4 September 2026Doc update+31 / −33 lines

In brief

The article was refreshed with clearer wording for trigger selection and improved formatting for trigger and condition tables, along with updated metadata.

What Defender admins need to know

Administrators can use the clearer guidance when creating automation rules; no configuration changes are required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Determine the trigger

Do you want this automation rule to be activated when new incidents or alerts are created? Or anytime an incident gets updated?

Automation rules are triggered when an incident is created or updated or when an alert is created. Recall that incidents include alerts, and that both alerts and incidents can be created by analytics rules, of which there are several types, as explained in Threat detection in Microsoft Sentinel.

Trigger type Events that cause the rule to run
When incident is created Microsoft Defender portal:

  • - A new incident is created in the Microsoft Defender portal.

    Microsoft Sentinel not onboarded to the Defender portal:

  • - A new incident is created by an analytics rule.

  • - An incident is ingested from Microsoft Defender XDR.

  • - A new incident is created manually.
    		•
    When incident is updated
  • - An incident's status is changed (closed/reopened/triaged).

  • - An incident's owner is assigned or changed.

  • - An incident's severity is raised or lowered.

  • - Alerts are added to an incident.

  • - Comments, tags, or tactics are added to an incident.
    		•
    When alert is created
  • - An alert is created by a Microsoft Sentinel Scheduled or NRT analytics rule.
    		•

    Create your automation rule

    The following steps in this section apply to most automation rule creation scenarios.

    If you're looking to suppress noisy incidents and are working in the Azure portal, try handling false positives.

    If you want to create an automation rule to apply to a specific analytics rule, see Set automated responses and create the rule.

    To create your automation rule:rule:

    1. For Microsoft Sentinel in the Azure portal, select the Configuration > Automation page. For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Configuration > Automation.

    Choose your trigger

    From the Trigger drop-down, select the appropriate trigger according to the circumstance for whichthat matches when you're creating want the automation rule to run—When incident is created, When incident is updated, or When alert is created. 

    If you selected **When an incident is updated** as the trigger, start by defining your conditions, and then adding extra operators and values as needed.

    To define your conditions:conditions:

    1. Select a property from the first drop-down box on the left. You can begin typing any part of a property name in the search box to dynamically filter the list, so you can find what you're looking for quickly.

      Property Operator set
      - Title
      - Description
      - All listed entity properties
        (see supported entity properties)      		 - Equals/Does not equal
      - Contains/Does not contain
      - Starts with/Does not start with
      - Ends with/Does not end with
      - Tag (See individual vs. collection) Any individual tag:
      - Equals/Does not equal
      - Contains/Does not contain
      - Starts with/Does not start with
      - Ends with/Does not end with

      Collection of all tags:
      - Contains/Does not contain
      - Severity
      - Status
      - Custom details key      		 - Equals/Does not equal
      - Tactics
      - Alert product names
      - Custom details value
      - Analytic rule name      		 - Contains/Does not contain

      Conditions available with the update trigger

      Property Operator set
      - Title
      - Description
      - All listed entity properties
        (see supported entity properties)      		 - Equals/Does not equal
      - Contains/Does not contain
      - Starts with/Does not start with
      - Ends with/Does not end with
      - Tag (See individual vs. collection) Any individual tag:
      - Equals/Does not equal
      - Contains/Does not contain
      - Starts with/Does not start with
      - Ends with/Does not end with

      Collection of all tags:
      - Contains/Does not contain
      - Tag (in addition to above)
      - Alerts
      - Comments      		 - Added
      - Severity
      - Status      		 - Equals/Does not equal
      - Changed
      - Changed from
      - Changed to
      - Owner - Changed. If an incident's owner is updated via API, you must include the userPrincipalName or ObjectID for the change to be detected by automation rules.
      - Updated by
      - Custom details key      		 - Equals/Does not equal
      - Tactics - Contains/Does not contain
      - Added
      - Alert product names
      - Custom details value
      - Analytic rule name      		 - Contains/Does not contain

      Conditions available with the alert trigger

    Conditions based on custom details

    You can set the value of a custom detail surfaced in an incident as a condition of an automation rule. Recall that custom details are data points in raw event log records that can be surfaced and displayed in alerts and the incidents generated from them. Use custom details to get to the actual relevant content in your alerts without having to dig through query results.

    Known limitation: When using custom detail values, the Does not contain operator might fail to evaluate correctly when multiple (two or more) distinct values are present.

    To add a condition based on a custom detail:detail:

    1. Create a new automation rule as described in Create your automation rule.

    | Less than two minutes | Up to two minutes after playbook began running,
    but no more than 10 seconds after the playbook is completed | | More than two minutes | Two minutes after playbook began running,
    regardless of whether or not it was completed |

    Next stepsRelated content

    In this document, you learned how to use automation rules to centrally manage response automation for Microsoft Sentinel incidents and alerts.