Blog Post

Microsoft Defender XDR Blog
1 MIN READ

Assign incidents and alerts to someone else

Idan_Pelleg's avatar
Idan_Pelleg
Icon for Microsoft rankMicrosoft
Oct 03, 2021
You can now assign incidents and alerts to someone else in your organization   To control and manage incidents and alerts in the organization, sometimes you would need to assign them to a specifi...
Published Oct 03, 2021
Version 1.0
Zvoltejinylogin's avatar
Zvoltejinylogin
Copper Contributor
Oct 05, 2021

This is somewhat nice feature, but you can do much more if using Sentinel.

 

Ingesting Defender 365 (preview) connector ingesting just the free Incidents and Alerts option you get the whole D365 package (MCAS, D365 family) and once you assign these in Sentinel this is bi-directional and assignee visible in D365 portal, closing also works.

 

Drawbacks, if you try to close MCAS alerts ingested via D365 connector, as per MS Case - ATP -> MCAS uses deprecated API that no matter what closure status you put in Sentinel, it always will be True Positive in MCAS, no ETA for fix.

 

But there are automation/playbook options if you want to integrate all the D365 and Azure Security solutions, but Microsoft is not making it easy, there is a lot of DIY behind the scenes.