Forum Discussion
Closing an Incident in Azure Sentinel and Dismissing an Alert in ASC || Defender || MCAS etc
Hi GUYS ,
We are in process of designing an Playbook that can close the alert from the generator Portals Like defender ,MCAS ,M365 etc.
If we close the alert on sentinel page playbook should trigger to close alerts from Portals of M365 etc
Any ideas ...
- CliveWatson
Microsoft
There is an MCAS/Azure Defender example in the Github https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks Look for the ones that are called "Close- "
The Microsoft 365 Defender (preview) connector is bi-directional, so you can close an alert in M365 or Azure Sentinel and the two will sync.
