Microsoft 365 Defender - Integration

Question

I am currently testing the Microsoft 365 Defender Integration (XDR) v26.0 and have noticed that if I trigger 2 x events that create 2 x Incidents in XDR that become correlated under a new Incident Name, the new Incident Name is not reflected in Google SecOps SOAR, this seems to be by design however, I would like the case in SecOps SOAR to reflect the new Incident Name in XDR, I was thinking of utilising a KQL Query in a playbook to do this, any thoughts?

Trigger an event Incident 123456 (Test Incident 1) created in XDR
Trigger an event Incident 123457 (Test Incident 2) created in XDR
Ingest takes place in SOAR Case 5672 created with the Name Test Incident 1
Correlation takes place in XDR Incident 123457 closed and alert moved to 123456 in XDR
Incident 123456 renamed from Test Incident 1 to Suspicious Activity on Endpoint
SOAR Case attaches new Alert to Case 5672 and Case name stays as Test Incident 1

Thanks

Daryll

dnehoda · Answer

That is a classic downstream side-effect of how Microsoft 365 Defender handles dynamic incident evolution versus how SOAR platforms handle case creation. You are exactly right—by design, the SOAR connector creates the case using the initial payload metadata it sees. When Defender later updates the parent incident name or merges alerts, the SOAR case name remains static to avoid disrupting an analyst's active queue.

Your idea of using a playbook to automatically update the case name is spot-on. However, instead of using a raw KQL Query via Advanced Hunting, you will likely find it much cleaner and more reliable to use the native "Get Incident Details" (or equivalent API fetching) action built into the Microsoft 365 Defender integration.

Advanced Hunting KQL (AlertInfo / AlertEvidence tables) is optimized for security event logs rather than live incident management state changes, so it can sometimes suffer from a slight replication delay. Hitting the Microsoft Defender Incident API directly will always give you the exact, real-time string of that consolidated incident name.

Sign up

Login with SSO

Login to the community

Login with SSO