Forum Discussion

dnivaraxTE's avatar
dnivaraxTE
Copper Contributor
Jul 02, 2025

can we disable Multi Stage grouping in Sentinel/ Defender

Hi MS folks,

is there a way to disable multi stage grouping in Sentinel/Defender.

I understand the efficiently of this multi stage grouping feature, however, I like to see is there any way of disable it.

Thanks
XSplunk

microsoft defender for endpoint

1 Reply

  • cyb3rmik3's avatar
    cyb3rmik3
    MVP
    Jul 04, 2025

    Hi dnivaraxTE​,

    as of this moment, there is no way to deactivate or override Multi-Stage Incident Grouping (MSIG) in Defender XDR, the same implies in Microsoft Sentinel.

    Some alternatives:

    • Work with SecurityAlert and AlertEvidence tables which will provide information on alerts rather than Incidents.
    • You may create custom analytic rules within Sentinel, which would allow incorporating Defender alerts and would give full control of how you Incidents are created and grouped.

    If I have answered your question, please mark your post as Solved

    If you like my response, please consider giving it a like

Resources