The XSOAR Admin Guide specifies that field-change trigger scripts allow automations to run whenever a designated incident field changes. Severity is a standard incident field, and when its value increases due to analyst action, a playbook, enrichment script, or correlation event, a field-change trigger can automatically run a script to notify teams.
Post-processing rules only run after an incident closes, making them unsuitable for real-time severity escalation alerts. SLA scripts respond to timer conditions, not field changes, and are used for SLA violations or deadline tracking. Server configuration does not provide automation behavior tied to field modifications.
Field-change triggers are explicitly documented as the mechanism to automate workflows for “reacting to changes in incident fields such as owner, severity, status, or custom fields.” When severity is updated, XSOAR evaluates matching triggers and runs the associated automation immediately.
Thus, only a field-change trigger script can reliably detect a severity escalation and execute a notification action the moment the field changes, making option C the correct and documented solution.
