Defender for Cloud security alerts: alert details, the Take action tab, triggering automation

When a Microsoft Defender for Cloud workload plan detects a threat, such as suspicious process execution on a virtual machine (VM), access to a storage account from a suspicious IP address, a SQL injection attempt or a suspicious Azure Resource Manager operation, it raises a security alert. Alerts appear on Defender for Cloud's Security alerts page and, through the integration with Defender XDR, in the Defender portal incident queue. They can also flow to Microsoft Sentinel through its Defender for Cloud connector. Remember that alerts come only from paid workload plans, not from posture management.