Trigger
A trigger is the event that starts automation: an alert arriving, an incident being created or updated, a schedule firing or a person pressing a button. Triggers decide which playbook runs and when, so they are part of the content you must rebuild when you move.
What Trigger means
Some platforms attach one playbook to an alert by priority. Others run every rule whose condition matches, in order. The difference changes behaviour even when the steps are identical.
Scheduled jobs are a trigger type that migration pages rarely mention, which is why the matrix treats them as their own playbook type.
Trigger in Microsoft Sentinel's own words
Sentinel automation rules fire on three triggers: incident created, incident updated and alert created for scheduled and near-real-time analytics rules. Microsoft Sentinel documentation, read 2026-11-03