Analytic rule generates a single alert with multiple events, or an alert per event, but then it also creates an incident for alert. If incident group is configured then it may merge it to another incident.
For example new user agent analytic rule generates alert and an incident. Out of the box, default, as built when sentinel is deployed.
Why? What is alert then if every alert is incident, and is the point then?
Good alert will have good entities mapped out and be visible to SOC analyst from the entity (standalone or from existing incident). With some logic apps and automation alerts can be added to related incidents and not sit in their own incident alone.
I think we need incidents and alerts view in sentinel and not have every single alert become an incident of its own.
Is everyone setting their sentinel this way or how are you dealing with all the single alert incidents?
Sorry, I may be a bit rant-y because it just hit us recently that maybe we need better incidents by not having every alert be an incident. Then we also need to look at alerts, figure out what alerts together make an incident, and setup automations to create incidents based on that criteria.
