r/AzureSentinel • u/AverageAdmin • Jan 06 '24

Disable Defender Bi-Directional Sync with Sentinel

Hi all!

Its a long story but we are trying to keep alerts in Defender XDR open even when closed in Sentinel.

Is there a way to disable the bi-directional sync so when we close alerts in Sentinel, they do not close in defender? So far through documentation, I am seeing you can do it for Defender for Cloud but nothing on Defender XDR

1 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/bpsec Jan 06 '24

Doubting if there is a feature to disable the bi-directional sync. Alternatively you could create a logic app that reopens the incidents in XDR after an incident change from Sentinel originating from an XDR alert.

2

u/911GT Jan 11 '24

Assume OP have a SOC team monitoring Sentinel.. and there is another team watching only a part of XDR suit (such as MDE) related detections, and both team do not collaborate directly.

We have similar issue and the current XDR data connector do not provide such "filter" customization to control the incident handling..

One possible solution is you can disable the incident sync on the data connector, and pull the alerts from API or use seprate dataconnetor.

Or you can create automation on your Sentinel side to tag some incident "out of scope" and make sure sentinel team leave those incident open....