Microsoft 365 Defender - Integration

Hey ​@delston,

If the Incident 2 in your example got closed automatically in XDR, then it should get closed in SecOps as well, but if it was left open, then there is limited way for SecOps to know that it got grouped under a different case.

The name of the case is determined by the first alert ingested into the case and it will not change automatically no matter what alert will get grouped into it, but you can build a custom logic via a sync job to make this logic more sophisticated.

Thanks ​@ylandovskyy 

I will open a support call as I am also seeing Alerts re-ingested depending on the action for instance:

• Once the correlation takes place in XDR the 2 x Alerts are re-ingested giving me 3 x Alerts where the first Alert is duplicated.
• If I add a comment the Alert is re-ingested giving me 4 x Alerts 

This has the downside of attaching the same playbook to the new alert, this is handled by checking for the First Alert and if this is false brach to Lock the Playbook.

​@delston there are certain properties that can have the alert ingested again. For example, new events / entities were associated with the Alert.

Comments, Assignee, Tags - all of this shouldn’t force the connector to have data re-ingested. So, I suggest to check, if the there no changes to the events.

​@delston just sharing our experience with the connector & job;

We have an timing issue with the connector and the job making it so we sometimes end up having multiple cases or new cases of already closed cases.

IE we close a case in SecOps → if the connector run happens before the job run → same case recreated. We don’t want to have a huge delay from when an XDR alert/incident is created to when the case is created in SecOps.

​@ylandovskyy, Imo the two should merge rather than being independant connector/job as there’s no reconsilliation during runtime for either or.

At this time, we have decided to create a custom integration to resolve this issue as the provided solution for syncing XDR alerts & incidents are insufficent.

​@zalmez Thanks for the feedback. 

​@zalmez  - Thanks for sharing your experience, I am of the same opinion the Ingest and Synch should be tied in some way even if the code is not fully merged. I will open a support call and let you know the outcome.

we also had some troubles with syncing and we decide on our own method of aggregation of similiar cases and close/re-close/reopen them depends on the status - but it is written in IDE and used in Jobs

So also would like to see other taughts on that

I just received the following update on the Case I have open:

“Our engineering team is actively investigating the issues you reported regarding the Microsoft 365 Defender integration, specifically the orphaned cases following XDR incident correlation and the re-creation of cases after closure in SOAR. They are working diligently to identify a resolution or determine potential backend enhancements to address these synchronization and timing behaviors.”

Thanks, Daryll

same here
Thanks for confirmation that it is ongoing on multiple customers

Hi All, 

I just received the following update on the Case I have open:

“I have received an update from our product engineering team regarding the integration issues between Chronicle SOAR and Microsoft 365 Defender, specifically where merging incidents in Defender leaves SOAR cases orphaned and closed cases are recreated. The engineering team has successfully completed the necessary code fixes for these issues, and they are scheduled to be deployed in the upcoming development release on 29 July 2026.”

Thanks, Daryll

Hi All,

An updated connector has now been released to address these issues, I will be testing over the coming days.

Version 28.0

Released on Jul 29, 2026

• Sync Alerts - Updated case syncing logic.
• Microsoft 365 Defender - Incidents Connector - Updated alert processing logic.

Thanks

​@delston how has the testing been going?

Testing overall is going well however, I have seen a couple of instances of strange behaviour which I am currently investigating, I am not sure if this is XDR or Google at this stage but all relate to when cases are correlated in XDR, will keep you updated.