Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Assigned to automation?

Copper Contributor


I have ran into an issue with my defender logs.
Since march 13th i stopped seeing incidents being assigned to automation in my log management tool.
We are using Splunk to get an overview for how many incidents the AiR is handling, but since march 13th it seems that incidents are no longer getting assigned to automation.

In the picture below you can see that a high volume of incidents are getting "null" as the value of assigned to, which i believe to be what should have been assigned to "Automation"

Is there anyone with similar issues or knows what the reason could be?



0 Replies