About year ago, we released the alert enrichment blog post covering a few new (at the time) capabilities in scheduled analytics rules.
The dynamic alert details section explained why and how we can...
Updated Dec 06, 2022
Version 1.0
Blog Post
Could you help me understand why this approach is preferable over just having the Defender for Cloud connector and having it show alerts directly in the Incidents? Is the added value mostly the fact that we can now group alerts together?
Also, in this example, is the Microsoft Incident Creation Rule set to not trigger incidents anymore but just alerts?