Forum Discussion
Multiple alerts generating an incident
I see in the Incident's page that there is a field that lists the number of alerts used to generate an incident. How does this work? How can you have multiple alerts generating a single incident? Is there any examples of this somewhere?
GaryBushey I think you might be asking about Advanced multistage attack detection in Azure Sentinel or Fusion rules. https://docs.microsoft.com/en-us/azure/sentinel/fusion
Fusion rules combine two or more alerts from Azure AD Identity Protection and Microsoft Cloud App Security to create one incident. For example "Impossible travel to atypical locations leading to suspicious cloud app administrative activity", the rule correlate multiple alerts in attempt to predict a multistage attack.
GaryBushey There would be a confusing concept here that Microsoft might need to consider fixing or providing better clarification. The alert you see can be either from Microsoft incident creation rule or scheduled analytics rule. An alert is generated when the rule matches the condition (a query executes and result is greater than a value - rule threshold). When an alert is generated an incident is generated and it appears in the Incident page. You can only see the alert by doing the query in the Log Analytics workspace that Azure Sentinel is connected to. The query would be simple as follows
SecurityAlert | where AlertName == "Your_Analytics_Rule_Name" | where ProductName == "Azure Sentinel" or ProviderName == "ASI Scheduled Alerts"For Microsoft incident creation rule simply query | where ProductName == "Azure Security Center" (for example if you want to query ASC alert https://azsec.azurewebsites.net/2019/12/10/working-with-azure-security-center-alert-from-azure-sentinel/)
You would be able to achieve multiple alerts to generate one incident when you toggle rule suppression On. When suppression is on Sentinel will not execute the query to generate another alert > incident. It might put many alerts to one generated incident.
GaryBushey I think you might be asking about Advanced multistage attack detection in Azure Sentinel or Fusion rules. https://docs.microsoft.com/en-us/azure/sentinel/fusion
Fusion rules combine two or more alerts from Azure AD Identity Protection and Microsoft Cloud App Security to create one incident. For example "Impossible travel to atypical locations leading to suspicious cloud app administrative activity", the rule correlate multiple alerts in attempt to predict a multistage attack.
ehloworldio That makes sense. Thanks.
