Forum Discussion

NAMM81's avatar
NAMM81
Copper Contributor
Oct 19, 2022

Ticket Sync between Sentinel and Defender for Cloud Apps

Hello

 

I have defender for Cloud APP syncing with sentinel to open incidents but when I close incidents in

Sentinel it doesn't close Defender for Cloud Apps alerts.

 

Is there any MSFT solution, I've already checked official MSFT links and so far I haven't found anything related to what I want.

Best regards

automation
azure
microsoft defender for cloud apps
siem
  • Clive_Watson's avatar
    Clive_Watson
    Bronze Contributor
    Oct 19, 2022

    NAMM81 

     

    You need the Microsoft 365 Defender (preview) enabled to do sync between products.  

     

    • NAMM81's avatar
      NAMM81
      Copper Contributor
      Nov 30, 2022
      The solution that you mention didn't work. The problem is the sync from sentinel to defender for cloud apps
    • NAMM81's avatar
      NAMM81
      Copper Contributor
      Oct 19, 2022
      Hello

      I will active the option Microsoft 365 Defender (preview) and validate if works and I will inform you.

      Thank you for your help

Resources