Forum Discussion
Microsoft Defender: Problems with correlations in Azure Sentinel
Hi community!
Sharing something we've noticed this week, in case anyone else is running into the same thing.
Since around October 31, several of our environments have been generating more incidents than before. Many of the automation rules we have deployed are based on the incident title, and they're now "failing" because the alert that creates the incident is being correlated and the incident is getting a different title. On top of that, I can't base these automation rules on the analytics rule name instead, because the alert comes from Defender and that condition isn't available for it in the automation rule.
In addition, some incidents from Sentinel analytics rules now show Defender-generated titles, even though they contain only a single alert. For example, the rule "Office365 Sharepoint File transfer Folders above threshold" now generates an incident called "Exfiltration incident involving one user", and "PoC - Nueva aplicación popular" now generates "Suspicious activity incident".
.
2 Replies
Thank you very much for the response. It turns out it was some kind of bug or issue on the Defender side that affected all clients; it was resolved on November 3rd around 11:12 UTC, and the nonsensical correlations stopped appearing. That said, we’ve learned that automation rules should be based on the "analytic rule name" rather than the incident "title," as a change in the name could cause a mismatch and prevent the automation from executing. Thank you very much for your response, Jamony.
Your screenshots show the alert name remaining specific while the incident receives a broader Defender title, even with one alert. Microsoft documents that Defender correlation can rename incidents, so incident titles are unsuitable as stable automation identifiers. A different title alone does not establish that the alert was grouped incorrectly.
For Sentinel-generated alerts, rebuild the conditions around the originating analytics rule and add tags where further distinction is needed. For Defender-origin alerts, evaluate the Enhanced Alert Trigger, which supports Defender/XDR alerts and granular conditions; the Sentinel analytics-rule-name condition cannot identify a Defender detection.
Test the replacement against both examples before replacing the existing automation. Also compare incident and alert counts separately around October 31 and review each rule’s correlation setting. If the increase remains unexplained, send representative incident IDs and timestamps through a support case; the screenshots cannot establish a service regression.
