Hi,
When using Automation rules in Sentinel, am I right in thinking that "when something occurs", the data is ran through the automation rules first?
If a matching Automation rule is found, then the rule will be obeyed and no further processing will occur.
If no matches are present, then Sentinel will process accordingly
The behaviour I see suggests this, so just looking for ratification, thankyou
