Closing an Incident in Azure Sentinel and Dismissing an Alert in ASC || Defender || MCAS etc

[NAyan325]

Hi GUYS ,

We are in process of designing an Playbook that can close the alert from the generator Portals Like defender ,MCAS ,M365 etc.

If we close the alert on sentinel page playbook should trigger to close alerts from Portals of M365 etc

Any ideas ...

[#2]

There is an MCAS/Azure Defender example in the Github https://github.com/Azure/Azure-Sentinel/tree/master/Playbooks Look for the ones that are called "Close- "

The Microsoft 365 Defender (preview) connector is bi-directional, so you can close an alert in M365 or Azure Sentinel and the two will sync.