Defender Sync Alerts Job

Hey there, 

From what you’ve shared, the issue may actually lay with the parser on the SIEM side. In the raw log, does the alert GUID contain the MS prefix for the source type (e.g. `ir` in your example)? 

It’s likely the capture pattern is looking for a proper GUID, which wouldn’t include the prefix that MS prepends. 

For the SOAR job itself, in my tenant on the latest version of the integration (last updated on Aug 11), the code for both that job + its associated manager checks out against the Graph API’s docs.

Looked at the raw logs and found 

metadata.product_log_id"ir5e7cb5ff-8a84-4d51-a473-21c52e45f9ee"
metadata.url_back_to_product"https://security.microsoft.com/alerts/ir5e7cb5ff-8a84-4d51-a473-21c52e45f9ee?tid=redacted"
additional.fields["provider_alert_id"]"5e7cb5ff-8a84-4d51-a473-21c52e45f9ee"

I have now created a parser extension to map the additional fields to alert_id

Thanks for the tip will post an update :)