How to use KQL to associate alerts with incidents?
There is no method I'm aware of to use KQL to query from an alertID to an incident or vice versa. Please provide kql examples for querying between XDR incidents and alerts. These queries should be independent of the SecurityIncident table which is only available when Sentinel is connected to XDR. Thank you.
Request to Remove Personal/Outdated Information from Bing Search
Hello Bing Team, I need urgent help regarding two Bing search results displaying personal or outdated information about me. LinkedIn snippet shows outdated information: https://ca.linkedin.com/in/tugbakalaman Bing still displays an old job title and company name, even though my LinkedIn profile was updated months ago. I tried using the content removal tool, but it didn’t work. Support told me the result may persist until Bing manually clears it. Bold.pro page contains personal address: https://ca.bold.pro/my/tugb This result shows my full home address and previous employment history, which I no longer want online. I do not use this profile anymore and urgently request its removal for privacy and safety reasons. I was directed here by Microsoft support to raise this issue for manual review. Please help me resolve this. Thank you for your time and support.
Teams search changed, and is now useless
I don't know when this happened but search has changed in teams recently, and it's unbelievably useless. Searching within a single conversation isn't intuitive. Took me forever to figure out how that works. But the biggest problem is that now when I search it returns results and in the past when I'd click the item in the results list, it would take me to that point in time of the entire conversation. Now it just shows me the single message and I can't see the entire conversation surrounding it. Since the conversation was back in July, and this is a person I talk to all day every day scrolling back to that point in time would take a VERY long time. Basically we're encountering an issue in our development environment that happened previously and I fixed it back in July but it's happening again and I don't remember what we did to fix it. So I search for the term I need, get the messages around that time in July, and I see just that one message but I need to see the entire conversation. This is a terrible change that wasn't thought through. How can I get it to rewind to that point in time without having to scroll up for 20 minutes?Help Needed to Make PowerApp Visible in Search Bookmark
Hello everyone, I have a problem that I can't seem to solve and I hope someone here can help me. I created a PowerApp that I want to make visible through a bookmark in Search. When I select, copy, and paste the app ID from PowerApps into the field in the bookmark settings, I get a message saying it's incorrect. For comparison, I created a page on a SharePoint site, placed the PowerApps web part there, and pasted the same ID. It works fine there. Does anyone have any idea what might be going wrong or what I might be overlooking? Any suggestions are welcome! Thanks in advance!
Defender XDR Unified Audit Logs
Hi, There used to be Unified Audit Logs -option in Defender XDR Settings under "Endpoints". This option has now disappeared. Trying to search for Defender XDR events, such as isolating devices etc. using the Purview Audit search, I don't get any results. From the XDR Action center history I can see that isolation actions have been performed. I have Security Administrator permissions. Is there a way to enable/disable the XDR auditing from Defender XDR or Purview portals?
Auto-append trailing * wildcard to search for substrings in modern sharepoint
I have a modern communication site and if I search a list for 'can', it will not return Canada, or Canadian in my results. but if I search for can*, both items will be returned. I believe it is possible to program classic search to append this wildcard automatically, so I don't need to type the * every time. But does anyone know how I can achieve this with modern search? And please no one reply with, "this isn't possible". It seems to me, that if this isn't possible, why hasn't Microsoft fixed this yet? I've never seen another intranet search engine work this way. Or am I missing a simple solution to this? Any help would be greatly appreciated. It is not natural for end users to have to remember to type a * at the end of their search string, which consequently returns poor results for their searches.."Copy to clipboard" balloon tip blocks Copy icon
If you have 1920x1080 screen resolution or higher, this annoying balloon tip wreaks havoc by blocking the "copy" icon. I find this balloon tip to be the least necessary thing ever. Everyone who's job involves using the Defender portal knows what that icon means and the fact that it is blue lets us know even more concretely that we can click it. Does anyone else have this issue and/or find this annoying? The next thing that is also problematic in the same way, the way we have to use these balloons to first sort columns ascending, before we can ever sort descending. And we can't just click the obvious arrows, we have to click, get the balloon, choose "Sort ascending", then click again, get the next balloon, finally choose "Sort descending". I'm flabbergasted as to how anyone thought this was going to be helpful (making a simply sort button require so many clicks just to sort columns). I give feedback in the portal about these two things often, but it doesn't go away. These 2 UI elements are no good, need to go.MDO query of EmailEvents is not accepted in the flow which is why causing the badgateway error
When used the following MDO query of EmailEvents it is working in the Defender control panel but when applied through 'Advanced Hunting' action in Power automate application given bad gateway error. Is this query supported in this application?
