Automation rule for triggering logic apps

[varchas]

I have created an Automation rule with an Incident update trigger where, when a tag 'create_ticket' is added to an incident in Sentinel, a playbook will be triggered. This automation rule is working fine as expected, but after adding the 'create_ticket' tag, if I add any other tag to the same incident, the automation rule along with the playbook is again getting triggered. I wanted to know why the automation rule is getting triggered even though the other tag added is a different one from the 'create_ticket' tag.

[#2]

If you set your rule to trigger when the tag equals "create_ticket" then it will trigger whenever a new tag is added or removed since there is still a tag called "create_ticket". I am not sure if this working as designed or a bug and I would suggest opening a ticket so it gets recorded.