Alert Policies Defender Portal
Incidents and response
The article now explains how to select a built-in rule on the Alert tuning page and choose Disable, with a supporting screenshot.
Cross-product topic
Incidents and response
A cross-product view of Microsoft Defender changes related to Incidents and response.
Latest Incidents and response changes
Microsoft Defender XDR: Detection source support in alert tuning rules
Incidents and response
Microsoft Defender XDR will allow alert tuning rules to target specific detection sources for finer control. This feature rolls out in public preview mid-October 2026 and general availability mid-November 2026. Existing rules apply to all sources unless updated. No action is needed unless customization is desired.
Accelerate OT alert workflows - Microsoft Defender for IoT
Incidents and response
The page now highlights required Azure portal permissions or OT sensor access, clarifies migration guidance for alert exclusion rules, and warns that deleting custom alert rules is irreversible. Links and wording were also updated.
Adjust alert thresholds | Microsoft Defender for Identity
Incidents and response
The page’s publication date and custom metadata were updated. It also includes a warning that reverting to default is irreversible and discards threshold-level changes.
Alert classification for suspicious inbox manipulation rules
Incidents and response
The playbook now more explicitly covers true and false positives, compromised accounts, rules without filters, activity before suspicious rules were created, and related alerts. Metadata and the publication date were also updated.
Alert Classification Malicious Exchange Connectors
Incidents and response
The page updates wording, metadata, and investigation guidance. Sample queries are now described as covering new connector creation, connector-to-mail-flow correlation, and external domain detection, with added admin logon checks.
Alert Classification Password Spray Attack
Incidents and response
The article now explains MFA fatigue, clarifies query descriptions and alert references, and adds a Kusto query to check whether MFA strong authentication requirements were removed from Microsoft Entra ID accounts.
Alert classification playbooks in Microsoft Defender XDR
Incidents and response
The page title and headings now explicitly reference Microsoft Defender XDR. An Overview section and an anchor for the available playbooks section were added, and the publication date was updated.
Alert Classification Suspicious Ip Password Spray
Incidents and response
The article updates its date and wording, and adds clearer instructions for the investigation queries. Administrators are told to set the `ip_address` variable, use an eight-hour lookback, and review legacy-protocol indicators, successful sign-ins, and related cloud app activity.
Alert Grading Playbook Email Forwarding
Incidents and response
The playbook now presents alert-review steps as a numbered sequence, clarifies terminology for the forwarding user and recipient lists, and refines investigation and remediation wording. Metadata and the documentation date were also updated.
Alert Grading Playbook Inbox Forwarding Rules
Incidents and response
The article now uses clearer terminology for investigating suspicious rule parameters, identifying the IP involved in inbox rule creation, and remediating account compromise. Its metadata and publication date were also updated.
Alert Policies Defender Portal
Incidents and response
The Microsoft Entra permissions description was clarified, and a Related content link was added for managing incidents and alerts in Microsoft Defender XDR.
Alert policies in the Microsoft Defender portal
Incidents and response
The article now notes that some default alert policies contain filters not shown in the Microsoft Defender portal. These filters can affect whether activities match conditions and trigger alerts, and the article provides a PowerShell command to view them.
Api Incident
Incidents and response
The documentation explains that lastUpdateTime identifies incidents changed after creation. It also states that severity may change when alerts are added or removed, and that the incident resource does not provide severity-change history.
Configure email alert notifications in Microsoft Defender XDR
Incidents and response
The page title and description now refer to Microsoft Defender XDR, setup step numbering was corrected, and a warning explains that deleting a notification rule permanently stops its future email notifications.
Create an incident report with Microsoft Copilot in Microsoft Defender
Incidents and response
The article was rewritten for clarity, explicitly states that Security Copilot access is required, and clarifies that resolving an incident before report generation helps capture all actions. Links, metadata, and descriptions were also updated.
Create Incident Manually
Incidents and response
The page date and custom metadata were updated, and the Microsoft Sentinel API description was clarified to identify the Incidents operation group and its get, create, update, and delete operations.
Create Incident Tasks in Microsoft Sentinel using Automation Rules
Incidents and response
The article was refreshed with clearer wording, a new introductory step description, updated links, and reorganized related content. Metadata and the publication date were also updated.
Customize Alert Details
Incidents and response
The article now directs readers to its alert details properties table for customization guidance and for identifying preview-labeled properties. It also updates the publication metadata and related-content introduction.
Delete Incident
Incidents and response
The article now clarifies the reference for deleting a single incident, adds a request for deleting an incident by ID, and updates its metadata and links.
Forward on-premises OT alert information to partners - Microsoft Defender for IoT
Incidents and response
The article now highlights prerequisites, explicitly lists Email, Syslog server, and NetWitness action types, and adds a certificate-validation troubleshooting subsection. Metadata and heading formatting were also updated.
Incident Navigate Triage
Incidents and response
The Microsoft Sentinel incident navigation and triage page now introduces required roles and permissions and provides steps for navigating to and triaging incidents. Its date and authoring metadata were also updated.
Incident Queue
Incidents and response
The documentation now states that the incident list defaults to incidents from the last week instead of the last six months. The listed 30-day option was removed.
Integrate with Microsoft Power Automate for custom alert automation
Incidents and response
The documentation now explicitly requires creating a Defender for Cloud Apps API token before creating playbooks and using that token in the connection’s authentication settings.
M365d Action Center
Incidents and response
The page adds introductory steps for opening and using Action center, updates the source-details heading and anchor, reformats the remediation-actions link, and refreshes the publication date.
Manage your SOC Better with Incident Metrics in Microsoft Sentinel
Incidents and response
The article title and section headings were revised, metadata was refreshed, and related-content links were updated and reworded.
Manually Create Incident
Incidents and response
The article now clarifies the Related incident step, adds navigation support, updates the date and metadata, and provides additional incident-management references.
Microsoft Defender for Endpoint sensitivity labels protect and prioritize incident response
Incidents and response
Three related links now point to updated Microsoft Learn and Microsoft Support URLs for sensitivity labels and DLP conditions.
Move alerts from one incident to another in the Microsoft Defender portal
Incidents and response
The article adds a permissions prerequisite, clarifies how to open the move panel and select alerts, and updates wording around feedback and saved moves.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated punctuation, list formatting, wording, role-based guidance formatting, and the link text for alert correlation and incident merging documentation.
Respond to an alert in the Azure portal - Microsoft Defender for IoT
Incidents and response
Updated the article’s wording for Azure portal alerts, source and destination devices, remediation steps, and learning or unlearning alert traffic. The free-account link and document metadata were also refreshed.
Security Alert Triage Agent
Incidents and response
The article now labels supported alert types more clearly, separates prerequisite guidance by alert category, updates RBAC terminology and links, and renames feedback guidance links. It also clarifies that existing Phishing Triage Agent users can enable additional alert types through configuration.
Session Cookie Theft Alert
Incidents and response
The article’s date was updated, wording was refined, an investigation-steps introduction was added, and references to Advanced hunting and business email compromise were made clearer.
Summarize an incident with Microsoft Copilot in Microsoft Defender
Incidents and response
The documentation now refers to Microsoft Defender instead of Microsoft Defender XDR in descriptions of Security Copilot-powered incident summaries and Defender correlation capabilities.
Normalization Schema Alert
Incidents and response
The documented supported value `Cryptominor` was corrected to `Cryptominer` in the alert normalization schema.
New Defender for Identity health alert for missing domain controller network traffic
Incidents and response
Microsoft Defender for Identity now includes a health alert for missing domain controller network traffic, helping administrators detect traffic collection issues affecting visibility. The alert appears in sensor health tabs, requires no pre-rollout action, and guides troubleshooting if triggered after rollout. No impact on end users or compliance.
Alert Policies
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-policies.md.
Alert Policies Defender Portal
Incidents and response
Updated Microsoft Defender documentation in defender-office-365/alert-policies-defender-portal.md.
Investigate an IP address associated with a Microsoft Defender for Endpoint alert
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/investigate-ip.md.
Review remediation actions in the Action Center
Incidents and response
Updated Microsoft Defender documentation in defender-business/mdb-review-remediation-actions.md.
Use Microsoft Defender for Endpoint sensitivity labels to protect your data and prioritize security incident response
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/information-protection-investigation.md.
Auto Investigation Action Center
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/auto-investigation-action-center.md.
Accessing incident notifications and DENs using Graph security API
Incidents and response
Added Microsoft Defender documentation in defender-xdr/defender-experts/defender-experts-hunting-graph-api.md.
Alert classification for password spray attacks
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-classification-password-spray-attack.md.
Alert classification for suspicious email forwarding activity
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-grading-playbook-email-forwarding.md.
Alert classification for suspicious inbox forwarding rules
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-grading-playbook-inbox-forwarding-rules.md.
Alert Classification Playbooks
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-classification-playbooks.md.
Alert Classification Suspicious Ip Password Spray
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-classification-suspicious-ip-password-spray.md.
Alert correlation and incident merging in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alerts-incidents-correlation.md.
Alert grading for session cookie theft alert
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/session-cookie-theft-alert.md.
Alert Grading Playbook Inbox Manipulation Rules
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-grading-playbook-inbox-manipulation-rules.md.
Alert policies in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in defender-office-365/alert-policies-defender-portal.md.
Api Incident
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/api-incident.md.
Configure alert notifications
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/configure-email-notifications.md.
Create an incident report with Microsoft Copilot in Microsoft Defender
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/security-copilot-m365d-create-incident-report.md.
Create incident tasks in Microsoft Sentinel using automation rules
Incidents and response
Updated Microsoft Defender documentation in sentinel/create-tasks-automation-rule.md.
Get incident notifications by email in Microsoft Defender XDR
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/m365d-notifications-incidents.md.
Manage your SOC better with incident metrics in Microsoft Sentinel
Incidents and response
Updated Microsoft Defender documentation in sentinel/manage-soc-with-incident-metrics.md.
Migrate Microsoft Sentinel incident creation rules to alert grouping in Microsoft Defender
Incidents and response
Added Microsoft Defender documentation in unified-secops-platform/migrate-sentinel-incident-creation-rules-alert-grouping.md.
Move alerts from one incident to another in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/move-alert-to-another-incident.md.
Overview of the Action center in Microsoft Defender XDR
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/m365d-action-center.md.
Plan an incident response workflow in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in unified-secops-platform/plan-incident-response.md.
Security Alert Triage Agent
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/security-alert-triage-agent.md.
Sentinel Security Copilot Incident Summary
Incidents and response
Updated Microsoft Defender documentation in sentinel/sentinel-security-copilot-incident-summary.md.
Summarize an incident with Microsoft Copilot in Microsoft Defender
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/security-copilot-m365d-incident-summary.md.
The Advanced Security Information Model (ASIM) Alert Events normalization schema reference
Incidents and response
Updated Microsoft Defender documentation in sentinel/normalization-schema-alert.md.
View and manage actions in the Action center
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/m365d-autoir-actions.md.
Microsoft Sentinel alert schema differences between standalone and XDR connectors
Incidents and response
Updated Microsoft Defender documentation in sentinel/security-alert-schema-differences.md.
Accelerate OT alert workflows - Microsoft Defender for IoT
Incidents and response
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-accelerate-alert-incident-response.md.
Accessing incident notifications and DENs using Graph security API
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/access-den-graph-api.md.
Adjust alert thresholds | Microsoft Defender for Identity
Incidents and response
Updated Microsoft Defender documentation in defender-for-identity/advanced-settings.md.
Create and perform incident tasks in Microsoft Sentinel using playbooks
Incidents and response
Updated Microsoft Defender documentation in sentinel/automation/create-tasks-playbook.md.
Forward on-premises OT alert information to partners - Microsoft Defender for IoT
Incidents and response
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/how-to-forward-alert-information-to-partners.md.
Integrate with Microsoft Power Automate for custom alert automation
Incidents and response
Updated Microsoft Defender documentation in defender-for-cloud-apps/flow-integration.md.
Link query results to an incident
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-link-to-incident.md.
Link query results to an incident
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/advanced-hunting-link-to-incident.md.
Migrate Microsoft Sentinel alert-trigger playbooks to automation rules
Incidents and response
Updated Microsoft Defender documentation in sentinel/automation/migrate-playbooks-to-automation-rules.md.
Normalization Schema Alert
Incidents and response
Updated Microsoft Defender documentation in sentinel/normalization-schema-alert.md.
Work with incident tasks in Microsoft Sentinel in the Azure portal
Incidents and response
Updated Microsoft Defender documentation in sentinel/work-with-tasks.md.
Create Incident Manually
Incidents and response
Updated Microsoft Defender documentation in sentinel/create-incident-manually.md.
Customize alert details in Microsoft Sentinel
Incidents and response
Updated Microsoft Defender documentation in sentinel/customize-alert-details.md.
Investigate an IP address associated with a Microsoft Defender for Endpoint alert
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/investigate-ip.md.
Microsoft Defender for Endpoint sensitivity labels protect and prioritize incident response
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/information-protection-investigation.md.
Incident Investigation
Incidents and response
Updated Microsoft Defender documentation in sentinel/incident-investigation.md.
Alert Policies
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-policies.md.
Alert policies in the Microsoft Defender portal
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-policies.md.
Quickstart: Create an automatic response to a specific security alert using an ARM template or Bicep
Incidents and response
Updated Microsoft Defender documentation in defender-for-cloud/quickstart-automation-alert.md.
Security alert correlation
Incidents and response
Updated Microsoft Defender documentation in defender-for-cloud/episode-thirty-five.md.
Visit the Action center to see remediation actions
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/auto-investigation-action-center.md.
Alert Validation
Incidents and response
Updated Microsoft Defender documentation in defender-for-cloud/alert-validation.md.
Manually create an incident or alert in Microsoft Defender
Incidents and response
Added Microsoft Defender documentation in defender-xdr/manually-create-incident.md.
Quickstart Automation Alert
Incidents and response
Updated Microsoft Defender documentation in defender-for-cloud/quickstart-automation-alert.md.
Security alert correlation | Defender for Cloud in the Field
Incidents and response
Added Microsoft Defender documentation in defender-for-cloud/episode-thirty-five.md.
Create a compromised identity incident response SOP template
Incidents and response
Added Microsoft Defender documentation in defender-xdr/sop-documentation-template.md.
Review remediation actions in the Action Center
Incidents and response
Updated Microsoft Defender documentation in defender-business/mdb-review-remediation-actions.md.
Session Cookie Theft Alert
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/session-cookie-theft-alert.md.
Alert Engine Messages
Incidents and response
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/alert-engine-messages.md.
Alert Classification Suspicious Ip Password Spray
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-classification-suspicious-ip-password-spray.md.
Alert Policies
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/alert-policies.md.
Alert Policies Defender Portal
Incidents and response
Updated Microsoft Defender documentation in defender-office-365/alert-policies-defender-portal.md.
Auto Investigation Action Center
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/auto-investigation-action-center.md.
Configure alert notifications
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/configure-email-notifications.md.
Get incident notifications by email
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/m365d-notifications-incidents.md.
M365d Action Center
Incidents and response
Updated Microsoft Defender documentation in defender-xdr/m365d-action-center.md.
Microsoft Defender for Endpoint sensitivity labels protect and prioritize incident response
Incidents and response
Updated Microsoft Defender documentation in defender-endpoint/information-protection-investigation.md.
Alert Engine Messages
Incidents and response
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/alert-engine-messages.md.
Alert Engine Messages
Incidents and response
Updated Microsoft Defender documentation in defender-for-iot-azure/organizations/alert-engine-messages.md.
Audit and track changes to incident tasks in Microsoft Sentinel in the Azure portal
Incidents and response
Updated Microsoft Defender documentation in sentinel/audit-track-tasks.md.
Basic incident tasks for Microsoft Sentinel incidents in the Azure portal
Incidents and response
Updated Microsoft Defender documentation in sentinel/incident-navigate-triage.md.
Collaborate in Microsoft Teams with a Microsoft Sentinel incident team
Incidents and response
Updated Microsoft Defender documentation in sentinel/collaborate-in-microsoft-teams.md.
Create and perform incident tasks in Microsoft Sentinel using playbooks
Incidents and response
Updated Microsoft Defender documentation in sentinel/automation/create-tasks-playbook.md.
Create incident tasks in Microsoft Sentinel using automation rules
Incidents and response
Updated Microsoft Defender documentation in sentinel/create-tasks-automation-rule.md.
Customize alert details in Microsoft Sentinel | Microsoft Docs
Incidents and response
Updated Microsoft Defender documentation in sentinel/customize-alert-details.md.
Extract incident entities with non-native actions
Incidents and response
Updated Microsoft Defender documentation in sentinel/tutorial-extract-incident-entities.md.
Manage your SOC better with incident metrics in Microsoft Sentinel | Microsoft Docs
Incidents and response
Updated Microsoft Defender documentation in sentinel/manage-soc-with-incident-metrics.md.
Microsoft Sentinel alert schema differences between standalone and XDR connectors
Incidents and response
Updated Microsoft Defender documentation in sentinel/security-alert-schema-differences.md.
Microsoft Sentinel incident investigation in the Azure portal
Incidents and response
Updated Microsoft Defender documentation in sentinel/incident-investigation.md.
Migrate your Microsoft Sentinel alert-trigger playbooks to automation rules | Microsoft Docs
Incidents and response
Updated Microsoft Defender documentation in sentinel/automation/migrate-playbooks-to-automation-rules.md.
Normalization Schema Alert
Incidents and response
Updated Microsoft Defender documentation in sentinel/normalization-schema-alert.md.
Sentinel Security Copilot Incident Summary
Incidents and response
Updated Microsoft Defender documentation in sentinel/sentinel-security-copilot-incident-summary.md.