Forum Discussion
Sentinel Automation same order for rules
Hello I wonder what will happen if for few automation rules we will set same order? For example 4 automation rules with order set to 1. Sentinel allows me to do so but I don't know the outcome. ...
https://learn.microsoft.com/en-us/azure/sentinel/create-manage-use-automation-rules#automation-rules-execution
"Automation rules are run sequentially, according to the order you determine. Each automation rule is executed after the previous one has finished its run. Within an automation rule, all actions are run sequentially in the order in which they are defined."
I suspect all 4 will run together, but it could cause issues if the one at order 2 relies on a specific one of the four? You'll have to test this - whats the use case for this?
"Automation rules are run sequentially, according to the order you determine. Each automation rule is executed after the previous one has finished its run. Within an automation rule, all actions are run sequentially in the order in which they are defined."
I suspect all 4 will run together, but it could cause issues if the one at order 2 relies on a specific one of the four? You'll have to test this - whats the use case for this?
- I'd like to auto close some incidents that I don't need to investigate. Completely independent automation rules. I wanted to change order because it takes too long sometimes.
