Automation rule
An automation rule is a condition-and-action object that runs on an event without a full playbook. In Sentinel it can set status, severity, owner and tags, close an incident, or call a Logic Apps playbook. Rules run in a fixed order, which is behaviour a migration must reproduce.
What Automation rule means
Rules suit light work: triage routing, suppressing known noise, assigning an owner. Heavier work goes to a playbook the rule calls.
Order matters. Two rules that each look right can conflict when they run in a different sequence, so record the order before you rebuild them.
Automation rule in Microsoft Sentinel's own words
Sentinel automation rules run sequentially by order number, and a rule can be exported as ARM JSON for use in CI/CD. Microsoft Sentinel documentation, read 2026-11-03