You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?

Question

Sunny · Accepted Answer

Connect the Microsoft Defender for Cloud data connector to Sentinel and enable incident creation for high-severity alerts. The Microsoft Defender for Cloud data connector in Sentinel, when connected, can automatically create Sentinel incidents from Defender for Cloud security alerts. You configure which severity levels create incidents. This is the native, one-step integration — no custom analytics rule is needed to convert Defender alerts into Sentinel incidents.

You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?

You are setting up Microsoft Sentinel to monitor your Azure environment. You need to automatically create an incident and notify the security team when Defender for Cloud raises a high-severity alert. What is the correct Sentinel component to configure?

📚 What This Question Tests

More Microsoft Sentinel Practice Questions