What should you do to provide the alerts to the administrator?

You are investigating an incident in Azure Sentinel that contains more than 127 alerts.

You discover eight alerts in the incident that require further investigation.

You need to escalate the alerts to another Azure Sentinel administrator.

What should you do to provide the alerts to the administrator?
A . Create a Microsoft incident creation rule
B. Share the incident URL
C. Create a scheduled query rule
D. Assign the incident

View Answer

Answer: D

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/sentinel/investigate-cases