How to stop incidents merging under new incident (MultiStage) in defender.
Dear All We are experiencing a challenge with the integration between Microsoft Sentinel and the Defender portal where multiple custom rule alerts and analytic rule incidents are being automatically merged into a single incident named "Multistage." This automatic incident merging affects the granularity and context of our investigations, especially for important custom use cases such as specific admin activities and differentiated analytic logic. Key concerns include: Custom rule alerts from Sentinel merging undesirably into a single "Multistage" incident in Defender, causing loss of incident-specific investigation value. Analytic rules arising from different data sources and detection logic are merged, although they represent distinct security events needing separate attention. Customers require and depend on distinct, non-merged incidents for custom use cases, and the current incident correlation and merging behavior undermines this requirement. We understand that Defender’s incident correlation engine merges incidents based on overlapping entities, timelines, and behaviors but would like guidance or configuration best practices to disable or minimize this automatic merging behavior for our custom and analytic rule incidents. Our goal is to maintain independent incidents corresponding exactly to our custom alerts so that hunting, triage, and response workflows remain precise and actionable. Any recommendations or advanced configuration options to achieve this separation would be greatly appreciated. Thank you for your assistance. Best regards
XDR advanced hunting region specific endpoints
Hi, I am exploring XDR advanced hunting API to fetch data specific to Microsoft Defender for Endpoint tenants. The official documentation (https://learn.microsoft.com/en-us/defender-xdr/api-advanced-hunting) mentions to switch to Microsoft Graph advanced hunting API. I had below questions related to it: 1. To fetch the region specific(US , China, Global) token and Microsoft Graph service root endpoints(https://learn.microsoft.com/en-us/graph/deployments#app-registration-and-token-service-root-endpoints ) , is the recommended way to fetch the OpenID configuration document (https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#fetch-the-openid-configuration-document) for a tenant ID and based on the response, the region specific SERVICE/TOKEN endpoints could be fetched? Since using it, there is no need to maintain different end points for tenants in different regions. And do we use the global service URL https://login.microsoftonline.com to fetch OpenID config document for a tenantID in any region? 2. As per the documentation, Microsoft Graph Advanced hunting API is not supported in China region (https://learn.microsoft.com/en-us/graph/api/security-security-runhuntingquery?view=graph-rest-1.0&tabs=http). In this case, is it recommended to use Microsoft XDR Advanced hunting APIs(https://learn.microsoft.com/en-us/defender-xdr/api-advanced-hunting) to support all region tenants(China, US, Global)?
MTO Portal MFA Prompt Not Loading
Hi We are using the mto portal to hunt across multiple tenants. My team get the "loading completed with errors" message and the prompt for "MFA Login Required". When they select this the window to authenticate opens and then closes instantly. When selecting the tenant name they can authenticate in a new tab directly to Defender in this tenant without any issue (but this does not carry over to the MTO portal). The old behaviour was that they selected "MFA Login Required" and they could authenticate to the tenants they needed to at that time. Is this happening to anyone else? Does anyone have any tips for managing multiple Defender instances using MTO? ThanksMSSP Multi-Tenant Handling with Lighthouse and Defender XDR
Hello, As far as I know an MSSP providers, leverages Azure Lighthouse to call and access multiple customer workspaces, which allows to manage analytics across tenants. My questions are: In the case of moving to Defender XDR, how would this be possible in a multi-tenant MSSP scenario? Even with Lighthouse, how does Defender XDR avoid merging incidents/alerts across different customers when the same entities are involved? How does Defender XDR differentiate identical IOCs (same IP, hash, etc.) that appear in multiple customers? Can MSSPs customize correlation logic to prevent false cross-tenant merges? Content Ownership & Sharing Most MSSPs do not want to share their proprietary content (custom rules, detections, playbooks, analytics, etc.) with customers. How is Defender XDR approaching this requirement to ensure MSSPs can operate without exposing their intellectual property? Example: Customer Test 1 has a port scan incident from IP 10.10.10.10. Customer Test 2 also has a port scan incident from the same IP 10.10.10.10. In Sentinel today, these would remain separate. But in Defender XDR, would these two alerts risk being merged into a single incident because the same entity is detected across tenants? Thanks in advance for any clarification.
Advanced Hunting Custom detection rule notification cannot be customized
Hello, We have a case with both Microsoft and US cloud about the custom detection rule created by a query. The problem that we have is that I want to send the rule's notification to an email group. However, after about 2 months of investigations, I was advised below: "We can go one of two routes. Either the alerts from Defender can be ingested into sentinel based on the custom detection rule you created, or the Entra Sign-in logs can be ingested allowing Sentinel to check the logs itself." Could you please help us find an easier solution for the notification or create a feature request so that we could have the configuration of notification for custom detection rules when creating the alert?
TVM still showing outdated vulnerabilities despite applications being up to date
Hi everyone, we’re using Microsoft Defender for Endpoint with Threat & Vulnerability Management (TVM) enabled. Lately, we've noticed that certain vulnerabilities (e.g., CVEs in browsers or third-party software) continue to be flagged on devices, even though the affected applications have been updated weeks ago. Example scenario: The device is actively onboarded and reporting to Defender XDR The application has been updated manually or via software deployment The correct version appears under Software Inventory However, the CVE still shows up under Weaknesses Has anyone experienced similar behavior? Are there any best practices to trigger a re-evaluation of vulnerabilities or force a TVM scan refresh? Would a device reboot or restarting the MDE service help in this case? Any insights, suggestions, or known workarounds would be greatly appreciated. Thanks in advance!From on-premises to cloud: Graph-powered detection of hybrid attacks with Microsoft exposure graph
Enterprises face an ever-evolving landscape of cybersecurity threats that require robust and adaptive defense strategies to protect multiple threat surfaces. Many organizations manage their resources across different realms, including on-premises and cloud environments, and create complex infrastructures, where interconnections between services, resources, and identities become vital. If not managed with caution and diligence, these interconnections can pose significant risks. Threat actors may exploit them to take over realms, conduct identity theft, exfiltrate data, engage in ransomware extortion, or engage in other malicious activities. Organizations deploy a variety of solutions to safeguard their workloads, whether they are on premises, or in the cloud. Many have adopted integrated platforms that offer a unified view of their security environment. Solutions like Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) are now essential. However, a significant gap emerges when dealing with attacks that span multiple layers within the enterprise, crossing various realms, where each realm lacks the context of the others, and shared entities (IP Address, User, and more) are non-existent. This limitation prevents the SOC teams from identifying the comprehensive attack chain, where the contextual correlation of low-medium confidence signals across the realms is essential, and effectively responding to such complex, multi-faceted threats. In this blog, we explain how the exposure graph, an integral part of our pre-breach security exposure solution, supercharges our post-breach threat protection capabilities to detect and respond to such multi-faceted threats. This contextual enrichment allows SOC teams to uncover and determine that the low-medium confidence signals across the realms are part of the same attack—from the earliest compromise of the first realm to the last. This is possible by correlating indicators of compromise with shared possible attack paths on the graph that cross the on-premises and move to the cloud, and vice-versa. We will emphasize on-hybrid attacks that move from on-premises environments to the cloud. Recognizing the Complexity of Hybrid Threats Exposure management solutions, such as Microsoft Exposure Management, have already identified the need to surface risks that cross these realms. These solutions are now exposing hybrid attack paths, providing the necessary context to understand and mitigate threats that span different layers and realms—in this case, on-premises and cloud—within the enterprise (read more). The exposure graph supercharges threat protection capabilities by focusing on a specific attack scenario that highlights this gap: a device compromise leading to an Azure environment takeover. In such scenarios, context is key to creating a holistic picture of the larger kill-chain. In this scenario, a device which isn’t joined to Entra is compromised using the threat actor’s payload delivery and an N-day exploit, allowing the threat actor to gain an initial foothold on the device. The threat actor then discovers an unexpired Entra session cookie residing in the browser. They perform credential theft and extract the cookie using known attack tools, with a goal to steal and assume the identity and permissions of the user that the cookie is tied to. After hijacking the cookie, the threat actor manages to compromise the user by replaying the cookie from their own device and pivoting to the cloud, successfully satisfying the multifactor authentication (MFA) requirement. The threat actor then discovers that this user is assigned with the Global Administrator Entra role, which results in a highly destructive on-premises to cloud privilege escalation. This might not be coincidental, as the user was targeted as part of a spear-phishing campaign, which resulted in the payload delivery and the initial access. The threat actor then shifts their focus to Azure, targeting the organization’s valuable data that resides in the cloud realm. They perform the elevate access operation within the Azure portal, thereby gaining privileged permissions over all Azure subscriptions in scope, allowing them to take over Azure. Finally, the threat actor commits mass data exfiltration from the discovered Azure storage accounts that reside in the Azure compromised subscriptions. This stolen data can later be sold on the dark web or used to commit ransomware extortion. Graph-based contextual detection & response In the above scenario, the threat actor’s pivot from on-premises to the cloud may easily be a blind spot, as there is no shared indication that the device sequence of events is related to the cloud sequence of events, because the former occurs in the context of the local account while the latter occurs in the context of the Entra identity. This prevents SOC teams from correlating operations across different realms (on-premises and cloud), as there are no shared entities. In addition, each realm detection capability might have low-medium confidence individually, but with context enrichment and cross-realm signal correlation, the result can be a high confidence threat detection capability that SOC teams can respond to effectively. As suspicious operations are detected within the device during the attack, including reconnaissance and discovery, credential theft, execution, and more, these detections often lack the context of the cloud user with an active logon session inside the device. Conversely, suspicious activity detected within Azure also lacks the context of previous suspected operations that occurred on the device. To bridge the gap, we utilize the Enterprise Exposure Graph to integrate both contexts and formulate a comprehensive picture of the destructive campaign, with high confidence. By enriching the XDR capabilities, we can correlate events through shared paths in the graph, allowing us to consolidate the device compromise, credential theft, and the cloud compromise and operations into a single, cohesive incident. Hybrid attack detection and response: How does this all work? The Enterprise exposure graph collects information about assets, users, secrets, workloads, and more. Secrets can be in the form of user tokens and cookies, cloud resource access keys, and more. One of the unique features of the graph is its ability to connect users and devices, using secrets (user cookies and tokens). By leveraging the capabilities of secret scanning on both on-premises and cloud machines within Microsoft Security Exposure Management (MSEM), the exposure graph surfaces connections between a device and a user. In the above attack scenario, when the ‘device’ ‘contains’ an Entra session cookie (also known as ‘entra-userCookie’ in the Microsoft exposure graph) within the browser, where the cookie ‘can authenticate as’ the user, the connection appears in the graph. For more details, please refer to our previous blog. We use these graph-based connections and context enrichments within Microsoft Defender XDR to detect destructive cross-realm attacks. By correlating events based on the connections between the endpoint device and the user's identity, we can generate a high-confidence unified alert, or an incident that correlates different alerts. This provides a comprehensive description of the attack, showing how a single threat actor moved from the device to the cloud. New Exposure Graph-based detection & response Alerts with the following titles in Microsoft Defender XDR can indicate threat activity of a hybrid attack in progress. Microsoft Defender XDR detections Initial Access Suspicious Azure sign-in by user with active session on a device involved in a credential theft attempt Privilege Escalation Suspicious Azure elevate access operation by a user with an active session on a device involved in a credential theft attempt Credential Access Suspicious Azure Storage account keys access by a user with an active session on a device involved in a credential theft attempt Collection Suspicious Azure VM snapshot downloads by a user with an active session on a device involved in a credential theft attempt Impact Suspicious Azure data store resources deletion attempt by a user with an active session on a device involved in a credential theft attempt Learn more Microsoft Security Exposure Management (MSEM) Start with Exposure Management documentation, product website, blogs Microsoft Security Exposure Management what's new page Device and user connections using cloud credentials detection blog Exposure Graph tables in Advanced Hunting: ExposureGraphEdges, ExposureGraphNodes Query the exposure graph Mitigation and Protection guidance Principle of least privilege for identities What is Conditional Access in Microsoft Entra ID? Microsoft-managed Conditional Access policies Microsoft Entra Conditional Access token protection Turn on Microsoft Entra ID protection Understanding Tokens in Microsoft Entra ID Protecting Tokens in Microsoft Entra ID Token theft playbook Endpoint detection and response in block mode - Microsoft Defender for Endpoint Use automated investigations to investigate and remediate threats - Microsoft Defender for Endpoint Microsoft Defender for Cloud documentation Protect your Azure subscriptions with Microsoft Defender for Cloud Microsoft Defender for Cloud integration into Defender XDR CloudAuditEvents table in the advanced hunting - Microsoft Defender XDRCannot use union * for Defender Hunting query to Create Detection Rule, so what other workarounds?
I tried to create custom detection rule from KQL query in Defender XDR: Advance Hunting by custom various variable to be able to submit, but for this query to be able to go through remediation setting of detection rule, I need the entity identifiable columns like AccountUpn, that I need to union with IdentityInfo schema. But detection rule seems not support the union * thing as the attached pic: I searched for the same problems that seems to be occurred in all system using KQL including in Microsoft Sentinel Logs but has no workaround to bypass. So, is there any way to get through this objective without strucking with union * problem?Can I get productName in Microsoft Graph API incident response?
When using Microsoft Graph Security API, is it possible to get the productName field directly in the incident response (e.g., from /security/incidents endpoint)? Or is it only available at the alert level via /security/incidents/{id}/alerts?
