Cloud Smart Alert Correlation Engine

[thomasdefise]

Hello,

Would it be possible to have more information about this feature?
I see that there is a page on the documentation https://docs.microsoft.com/en-us/azure/security-center/security-center-alerts-cloud-smart but I would like further information.

• Are those incidents automatically sent towards the mail specified within the Azure Security Center settings?
• Are those incidents logs within a specific table in a Log Analytics workspace table?

The main "Why ?" I'm asking those questions is that we would be sure, within our customers, that they correctly receive via mail, log analytics alerts, ..., without to having a look at the dashboard of Azure Security Center.

Kind Regards,

Thomas

[#2 · Accepted solution]

@thomasdefise 

Hi,

1) Incidents with high severity are automatically sent  to the security contacts specified in ASC settings (the same as alerts).

2) Incidents logs to the same table as the alerts in log analytics.

Thanks,

Tal.

[#3]

@tal_rosler
Thanks for the information