Forum Discussion
Automatically alert resolved in sentinel
If we resolve the alerts in microsoft 365 defender is there any way it automatically resolved in Microsoft sentinel also. Any assistance in this matter would be greatly appreciated.
- Hmm... this should be bi-directional without additional steps needed.
"Bi-directional sync between Sentinel and Microsoft 365 Defender incidents on status, owner, and closing reason."
https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration#working-with-microsoft-365-defender-incidents-in-microsoft-sentinel-and-bi-directional-sync
If this is not happening, I honestly suggest to open a support ticket
HeikeRitter
Microsoft
MicrosoftYay!!! So glad to read this!! Do you know what you had to change?
Hi Heike,
Greetings to you and hope you are doing well.
I'm not sure why it initially didn't worked. In order to make sure everything is done right, I reconnected the Microsoft Defender and Sentinel step by step this time. As a result, it started working properly. There may have been some error or something else that prevented it from connecting at first.
Thank you so much for your assistance. Having this information really helped me to re-establish the connection.
Greetings to you and hope you are doing well.
I'm not sure why it initially didn't worked. In order to make sure everything is done right, I reconnected the Microsoft Defender and Sentinel step by step this time. As a result, it started working properly. There may have been some error or something else that prevented it from connecting at first.
Thank you so much for your assistance. Having this information really helped me to re-establish the connection.
