You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

In Microsoft Sentinel, to automatically generate incidents when a specific pattern or behavior is detected by a query, you must create a scheduled analytics rule.

A scheduled query rule:

Runs a KQL query on a defined schedule (e.g., every hour).

Triggers an alert and incident when the query returns results.

Can map detections to MITRE ATT&CK tactics and techniques, aligning with the requirement for attack vector mapping.

Other options explained:

Fusion rule – Uses built-in machine learning for correlation, not custom KQL logic.

Query bookmark – Saves hunting results but does not trigger incidents.

Hunting livestream session – Used for live monitoring, not alert generation.

✅ Correct answer: C. a scheduled query rule