Forum Discussion
can we disable Multi Stage grouping in Sentinel/ Defender
Hi MS folks, is there a way to disable multi stage grouping in Sentinel/Defender. I understand the efficiently of this multi stage grouping feature, however, I like to see is there any way of d...
Hi dnivaraxTE,
as of this moment, there is no way to deactivate or override Multi-Stage Incident Grouping (MSIG) in Defender XDR, the same implies in Microsoft Sentinel.
Some alternatives:
- Work with SecurityAlert and AlertEvidence tables which will provide information on alerts rather than Incidents.
- You may create custom analytic rules within Sentinel, which would allow incorporating Defender alerts and would give full control of how you Incidents are created and grouped.
If I have answered your question, please mark your post as Solved
If you like my response, please consider giving it a like