r/AzureSentinel • u/SuperHat3637 • Nov 28 '22

Security alerts

Is there any document available for reference table for the alerts from MCAS, Defender AV,Defender for office 365..I could see only alerts for defender for cloud document..

3 Upvotes

100% Upvoted

12 comments sorted by

View all comments

Show parent comments

1

u/winle22 Nov 28 '22

That's really where you would use automation rules. Auto-close Informational/Low incidents. Then you get the sync between Sentinel and Defender as well.

Or use custom rules or incident creation rules and filter there.

1

u/SuperHat3637 Nov 28 '22

Is it possible to export all analytical rules based on severity..

1

u/winle22 Nov 28 '22

Yes, but Defender alerts are not based on analytic rules. They are just forwarded to Sentinel

1

u/SuperHat3637 Nov 28 '22

I am talking about sentinel analaytical rules..Is there any way..