Microsoft Defender: Problems with correlations in Azure Sentinel

Thank you very much for the response. It turns out it was some kind of bug or issue on the Defender side that affected all clients; it was resolved on November 3rd around 11:12 UTC, and the nonsensical correlations stopped appearing. That said, we’ve learned that automation rules should be based on the "analytic rule name" rather than the incident "title," as a change in the name could cause a mismatch and prevent the automation from executing. Thank you very much for your response, Jamony.