Exam XSIAM-Analyst Topic 3 Question 27 Discussion

The correct answer isA. When a playbook trigger is configured for an alert-regardless of severity-the playbook willautomatically run when the alert is grouped into an incident, unless a severity condition is specifically configured in the playbook trigger. By default, the playbook will execute for any alert (including low severity) as soon as it is grouped within an incident.
"A playbook that is configured as a trigger for an alert will automatically execute when that alert is grouped as part of an incident, independent of the alert's severity unless a specific severity threshold is set." Document Reference:XSIAM Analyst ILT Lab Guide.pdf Page:Page 38 (Automation section)