Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Closing an Incident in Azure Sentinel and Dismissing an Alert in ASC || Defender || MCAS etc

Copper Contributor


We are in process of designing an Playbook that can close the alert from the generator Portals Like defender ,MCAS ,M365 etc.

If we close the alert on sentinel page playbook should trigger to close alerts from Portals of M365 etc

Any ideas ...

1 Reply
There is an MCAS/Azure Defender example in the Github Look for the ones that are called "Close- "

The Microsoft 365 Defender (preview) connector is bi-directional, so you can close an alert in M365 or Azure Sentinel and the two will sync.