Incident settings determine whether alerts from a detection rule generate Microsoft Sentinel incidents and how those alerts are grouped. They form one stage of the scheduled-rule configuration workflow, alongside general details, rule logic, and automated response. section 8.4.4
Configure incident settings after defining the rule’s purpose and detection logic. This separates the condition that produces an alert from the operational decision to create and organize incidents for investigation. section 8.4.4
Brute-force login detection
A scheduled rule detects more than 10 failed logins within five minutes, a pattern associated with a possible brute-force attack. Incident settings determine how resulting alerts become Sentinel incidents and whether related alerts are grouped. section 8.4.4
