Automation: automation rules vs Logic Apps playbooks, triggers, incident tasks; watchlists, workbooks, UEBA and threat intelligence connectors

Sentinel has two automation layers. Automation rules are lightweight, built-in rules that run when incidents are created or updated, or when alerts are created. They can change status, severity or owner, add tags, add incident tasks and run playbooks. Rules have an order number (lower runs first), an optional expiration date, and conditions such as analytics rule name, severity, tag or entity values. They are ideal for triage: assign all phishing incidents to the email team, raise severity when a VIP account is involved, or close known-benign incidents automatically, perhaps for a limited time while a rule is fixed.