Defender Sentinel Sync

Question

The status of an incident in Sentinel does not sync with Microsoft 365 Defender (Alert product name Microsoft Cloud App Security) when the incident is closed. Has anyone else encountered this issue?I expected Microsoft 365 Defender and Sentinel to sync incidents on status, owner, and closing reason bi-directionally.&nbsp;Thanks

clive_watson · Answer

Are you using the (Preview) connector?https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-integration-with-azure-sentinel?view=o365-worldwide#:~:text=The%20Microsoft%20365%20Defender%20connector%20for%20Microsoft%20Sentinel,to%20Microsoft%20Sentinel%20and%20keeps%20the%20incidents%20synchronized.

nics · Answer

Yes, we are using Defender 365(Preview) connector

simbur999 · Answer

NicS&nbsp;we have a similar issue -Did you have any success with automating closure of MCAS with correct status?&nbsp; I found this article about using API connection, but it's from 2020 so I'm unsure if it is still required.Microsoft Cloud App Security (MCAS) Activity Log in Azure Sentinel - Microsoft Tech Community&nbsp;In our case, with the Sentinel security extension enabled in MCAS, Sentinel does not update MCAS alert at all.&nbsp; If we disable the security extension, it does update but incorrectly e.g. Close an alert in Sentinel as False Positive - benign, automatically closes alert in MCAS as True Positive.&nbsp;Anyone know how to get MCAS updated correctly based on Sentinel Incident closure?&nbsp;I assume this matters because the logic for alerting in MCAS would be skewed by alerts being closed with incorret status?&nbsp;

simbur999 · Answer

In our case a removal and redeployment of the Defender for Cloud solution in Sentinel has resolved the issue. There was also some confusion with closing incidents as benign positive in Sentinel. Benign positive is reported as 'True positive' in areas of Defender for Cloud Apps (specifically when opening an incident in Cloud Apps portal, you are notified that MSATP has automatically resolved the incident as True Positive). This is all good of course, since the different portals do not have the same selections for resolution or closure (you even 'close' an incident in Sentinel as opposed to 'resolved' in Cloud Apps) 😃Semantics really! True and Benign positives are both 'True' posiitves so it is expected (but potentially confusing).

Forum Discussion

Defender Sentinel Sync

4 Replies

Resources