Microsoft Defender XDR
Incidents and responseMove alerts from one incident to another in the Microsoft Defender portal
In brief
The article adds a permissions prerequisite, clarifies how to open the move panel and select alerts, and updates wording around feedback and saved moves.
What Defender admins need to know
Administrators can use the clarified guidance to verify access and follow the alert-moving procedure.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Move alerts from one incident to another in the Microsoft Defender portal
Prerequisites
Before you move alerts between incidents, make sure you have the following permissions:
- Users must have permissions to view the incidents queue.
- Users must have read and write permissions on all the alerts they wish to move between incidents.
Access the panel to move alerts
There are many ways to getopen the Move alerts to thisanother incident panel. You can access it from anywhere you can select or take action on alerts. For example:
In any of the following locations, select one or more alerts by marking the checkboxes at the beginning of their rows. When one or more alerts are marked, the Move alerts to another incident button appears on the toolbar.
Select the alert or alerts to move
To choose the alerts you want to move and open the move panel, follow these steps:
Open the Incidents queue, the Alerts tab on the incident details page, the Alerts queue, or an alert details page.
Select the alert or alerts you want to move by marking the checkboxes at the beginning of their rows in the queue. When one or more alerts are marked, the Move alerts to another incident button appears on the toolbar.
:::image type="content" source="media/move-alert-to-another-incident/move-alert-to-another-incident-from-alerts-tab.png" alt-text="Screenshot of selecting alerts from the queue to move to another incident." lightbox="media/move-alert-to-another-incident/move-alert-to-another-incident-from-alerts-tab.png":::
Select Move alerts to another incident from the toolbar. A flyout panel opens. If you selected only one alert, the panel is labeled Move alert to another incident. If you selected two or more alerts, it's labeled Move multiple alerts to another incident. In all other respects,
it'sthesame panel.flyout panel is the same.If the alert or alerts belong with another existing incident, select Link to an existing incident. Otherwise, select Create a new incident. Alerts must belong to an incident.
:::image type="content" source="media/move-alert-to-another-incident/move-alert-to-existing-incident-save.png" alt-text="Screenshot of adding a comment explaining why moving an alert.":::
Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options.
This stepProviding feedback helps Microsoft improve alert correlation in the future.Select Save at the bottom of the panel to execute the move.
If you selected Create a new incident, enter a comment explaining why you want to move the alerts.
Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options.
This stepProviding feedback helps Microsoft improve alert correlation in the future.Select Save at the bottom of the panel to execute the move.
:::image type="content" source="media/move-alert-to-another-incident/move-alert-to-new-incident.png" alt-text="Screenshot of selecting a new incident to move an alert to.":::
WhenAfter theprocessmove iscompleted,saved, a new incident is created with the alert or alerts you moved to it. The incident is given a name automatically based on the name of the alert or alerts.
Review activity log entries for moved alerts
@@ -11,12 +11,12 @@ ms.collection: - usx-security - sentinel-only ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/02/2026 appliesto: - Microsoft Defender XDR - Microsoft Sentinel in the Microsoft Defender portal ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Move alerts from one incident to another in the Microsoft Defender portal@@ -27,12 +27,14 @@ This article explains how to move alerts from one incident to another. ## Prerequisites +Before you move alerts between incidents, make sure you have the following permissions:+ - Users must have permissions to view the incidents queue. - Users must have read and write permissions on all the alerts they wish to move between incidents. ## Access the panel to move alerts -There are many ways to get to this panel. You can access it from anywhere you can select or take action on alerts. For example:+There are many ways to open the **Move alerts to another incident** panel. You can access it from anywhere you can select or take action on alerts. For example: In any of the following locations, select one or more alerts by marking the checkboxes at the beginning of their rows. When one or more alerts are marked, the **Move alerts to another incident** button appears on the toolbar. @@ -44,13 +46,15 @@ Also, on the details panel on an alert details page, the **Move alert to another ## Select the alert or alerts to move +To choose the alerts you want to move and open the move panel, follow these steps:+ 1. Open the **Incidents** queue, the **Alerts** tab on the incident details page, the **Alerts** queue, or an alert details page. 1. Select the alert or alerts you want to move by marking the checkboxes at the beginning of their rows in the queue. When one or more alerts are marked, the **Move alerts to another incident** button appears on the toolbar. :::image type="content" source="media/move-alert-to-another-incident/move-alert-to-another-incident-from-alerts-tab.png" alt-text="Screenshot of selecting alerts from the queue to move to another incident." lightbox="media/move-alert-to-another-incident/move-alert-to-another-incident-from-alerts-tab.png"::: -1. Select **Move alerts to another incident** from the toolbar. A flyout panel opens. If you selected only one alert, the panel is labeled **Move alert to another incident**. If you selected two or more alerts, it's labeled **Move multiple alerts to another incident**. In all other respects, it's the same panel.+1. Select **Move alerts to another incident** from the toolbar. A flyout panel opens. If you selected only one alert, the panel is labeled **Move alert to another incident**. If you selected two or more alerts, it's labeled **Move multiple alerts to another incident**. In all other respects, the flyout panel is the same. 1. If the alert or alerts belong with another existing incident, select **Link to an existing incident**. Otherwise, select **Create a new incident**. Alerts must belong to an incident. @@ -66,7 +70,7 @@ To move the selected alerts to an existing incident, complete the following step :::image type="content" source="media/move-alert-to-another-incident/move-alert-to-existing-incident-save.png" alt-text="Screenshot of adding a comment explaining why moving an alert."::: -1. Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options. This step helps Microsoft improve alert correlation in the future.+1. Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options. Providing feedback helps Microsoft improve alert correlation in the future. 1. Select **Save** at the bottom of the panel to execute the move. @@ -76,13 +80,13 @@ To create a new incident for the selected alerts, follow these steps: 1. If you selected **Create a new incident**, enter a comment explaining why you want to move the alerts. -1. Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options. This step helps Microsoft improve alert correlation in the future.+1. Provide feedback explaining why you are moving the alert or alerts by selecting one of the predefined options. Providing feedback helps Microsoft improve alert correlation in the future. 1. Select **Save** at the bottom of the panel to execute the move. :::image type="content" source="media/move-alert-to-another-incident/move-alert-to-new-incident.png" alt-text="Screenshot of selecting a new incident to move an alert to."::: - When the process is completed, a new incident is created with the alert or alerts you moved to it. The incident is given a name automatically based on the name of the alert or alerts.+ After the move is saved, a new incident is created with the alert or alerts you moved to it. The incident is given a name automatically based on the name of the alert or alerts. <a name="activity-log"></a> ## Review activity log entries for moved alerts