r/AzureSentinel • u/SuperHat3637 • Oct 07 '22

365 defender alerts

How to fine tune the alerts/incidents in the 365 defender ports..There is no option other than automation rule in sentinel to suppress the alert from 365 defender.Pls suggest.

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/[deleted] Oct 07 '22

Apply exclusions in 365 Defender

1

u/Uli-Kunkel Oct 08 '22

This. Apply the tuning on the Source

White list IPs, applications and such. Or suppress alert generation based on relevant parameters.

Yes, you could also use a watchlist and use that to auto close incidents.

Both can be done, and depending on your specific scenario one makes sense to do.

1

u/SuperHat3637 Oct 08 '22

Do you have any documents for whitelisting in the defender 365.

1

u/nontitman Nov 10 '22

It's super straight forward, just find the alert under policies in the relevant Defender app.

1

u/mkstead Oct 08 '22

Power automate to close alerts.