Your SOC uses several Microsoft Sentinel automation rules that trigger when incidents are created. One automation rule is meant to close incidents generated by a specific benign analytics rule during scheduled maintenance windows, but analysts report these incidents are still being assigned to a team and having playbooks executed before they are closed. You confirm all rules use the 'When incident is created' trigger. What should you change to ensure the closing automation rule takes effect before the others act on these incidents?