A team wants to automate a supported sequence of actions after a Sentinel incident meets defined conditions. Which capability is the closest fit?

1. Automation rules and playbooks
2. A password expiry notice only
3. A dashboard title alone
4. A retention period alone