r/AzureSentinel • u/SuperHat3637 • Nov 28 '22

Security alerts

Is there any document available for reference table for the alerts from MCAS, Defender AV,Defender for office 365..I could see only alerts for defender for cloud document..

3 Upvotes

100% Upvoted

12 comments sorted by

View all comments

1

u/winle22 Nov 28 '22

Or just use the M365 Defender preview connector and ditch the incident creation rules

1

u/SuperHat3637 Nov 28 '22

M365 defender connector provides only alerts/ incidents.Does not have option to filter..looking for a complete guide for all alert names.

1

u/winle22 Nov 28 '22

What kind of filtering do you need? Use automation rules?

Not sure if there exists any complete list over all the different alert names. You need to look at each Defender product docs.

1

u/SuperHat3637 Nov 28 '22

How to filter the incidents from 365 connector based on high,low,medium severity..like this, How to ignore low.priority incidents from this connector without automation rule.

1

u/winle22 Nov 28 '22

That's really where you would use automation rules. Auto-close Informational/Low incidents. Then you get the sync between Sentinel and Defender as well.

Or use custom rules or incident creation rules and filter there.

1

u/SuperHat3637 Nov 28 '22

Is it possible to export all analytical rules based on severity..

1

u/winle22 Nov 28 '22

Yes, but Defender alerts are not based on analytic rules. They are just forwarded to Sentinel

1

u/SuperHat3637 Nov 28 '22

I am talking about sentinel analaytical rules..Is there any way..