Microsoft Defender XDR
GeneralAlerts Incidents Correlation
In brief
The article now describes the Recommended correlations filter, including incidents not correlated into the current incident, and a Summary-tab card explaining potential attack relationships.
What Defender admins need to know
Administrators can review a broader attack story while related incidents retain their own ownership, status, and lifecycle until merged.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- tier1
- sentinel-only
ms.topic: concept-article
ms.date: 2026-
10-11-04T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 11ef3ff8-0b63-1e8e-c5a3-837e19da4a14
The Defender portal's correlation activities don't stop when incidents are created. Defender continues to detect commonalities and relationships between incidents and alerts in separate incidents. When multiple incidents are determined to be alike, Defender merges the incidents into a single incident.
View associated incidentsrecommended correlations without changing correlation behavior
In the investigation experience, you can expand context by changingattack story, use the associatedRecommended correlations filter to select individual related incidents view fromor This incident onlyAll recommended correlations to All associated incidents.view with the current incident.
This view helps analysts see additional related incidents and alerts in the investigation graph. It includes incidents that weren't correlated into the current incident, so analysts can see the full attack story in one view. It doesn't change incident grouping, correlation rules, or merge logic.
Items shown in All associated incidentsRecommended correlations can remain separate incidents with their own owner, status, and lifecycle until an actual incident merge occurs.
On the Summary tab, the Recommended correlations card explains why some of these incidents might be part of the same attack.
Criteria for merging incidents
@@ -19,7 +19,7 @@ ms.collection: - tier1 - sentinel-only ms.topic: concept-article-ms.date: 2026-10-04T00:00:00.0000000Z+ms.date: 2026-11-04T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 11ef3ff8-0b63-1e8e-c5a3-837e19da4a14@@ -77,13 +77,15 @@ For step-by-step guidance, see one of the following articles:
The Defender portal's correlation activities don't stop when incidents are created. Defender continues to detect commonalities and relationships between incidents and alerts in separate incidents. When multiple incidents are determined to be alike, Defender merges the incidents into a single incident.
-### View associated incidents without changing correlation behavior
+### View recommended correlations without changing correlation behavior
-In the investigation experience, you can expand context by changing the associated incidents view from **This incident only** to **All associated incidents**.
+In the attack story, use the **Recommended correlations** filter to select individual related incidents or **All recommended correlations** to view with the current incident.
-This view helps analysts see additional related incidents and alerts in the investigation graph. It doesn't change incident grouping, correlation rules, or merge logic.
+This view helps analysts see additional related incidents and alerts in the investigation graph. It includes incidents that weren't correlated into the current incident, so analysts can see the full attack story in one view. It doesn't change incident grouping, correlation rules, or merge logic.
-Items shown in **All associated incidents** can remain separate incidents with their own owner, status, and lifecycle until an actual incident merge occurs.
+Items shown in **Recommended correlations** can remain separate incidents with their own owner, status, and lifecycle until an actual incident merge occurs.
+
+On the **Summary** tab, the **Recommended correlations** card explains why some of these incidents might be part of the same attack.
### Criteria for merging incidents