Microsoft 365 Defender - Integration

Hey ​@delston,

If the Incident 2 in your example got closed automatically in XDR, then it should get closed in SecOps as well, but if it was left open, then there is limited way for SecOps to know that it got grouped under a different case.

The name of the case is determined by the first alert ingested into the case and it will not change automatically no matter what alert will get grouped into it, but you can build a custom logic via a sync job to make this logic more sophisticated.

Thanks ​@ylandovskyy 

I will open a support call as I am also seeing Alerts re-ingested depending on the action for instance:

• Once the correlation takes place in XDR the 2 x Alerts are re-ingested giving me 3 x Alerts where the first Alert is duplicated.
• If I add a comment the Alert is re-ingested giving me 4 x Alerts 

This has the downside of attaching the same playbook to the new alert, this is handled by checking for the First Alert and if this is false brach to Lock the Playbook.

​@delston there are certain properties that can have the alert ingested again. For example, new events / entities were associated with the Alert.

Comments, Assignee, Tags - all of this shouldn’t force the connector to have data re-ingested. So, I suggest to check, if the there no changes to the events.

​@delston just sharing our experience with the connector & job;

We have an timing issue with the connector and the job making it so we sometimes end up having multiple cases or new cases of already closed cases.

IE we close a case in SecOps → if the connector run happens before the job run → same case recreated. We don’t want to have a huge delay from when an XDR alert/incident is created to when the case is created in SecOps.

​@ylandovskyy, Imo the two should merge rather than being independant connector/job as there’s no reconsilliation during runtime for either or.

At this time, we have decided to create a custom integration to resolve this issue as the provided solution for syncing XDR alerts & incidents are insufficent.

​@zalmez Thanks for the feedback. 

​@zalmez  - Thanks for sharing your experience, I am of the same opinion the Ingest and Synch should be tied in some way even if the code is not fully merged. I will open a support call and let you know the outcome.

we also had some troubles with syncing and we decide on our own method of aggregation of similiar cases and close/re-close/reopen them depends on the status - but it is written in IDE and used in Jobs

So also would like to see other taughts on that

I just received the following update on the Case I have open:

“Our engineering team is actively investigating the issues you reported regarding the Microsoft 365 Defender integration, specifically the orphaned cases following XDR incident correlation and the re-creation of cases after closure in SOAR. They are working diligently to identify a resolution or determine potential backend enhancements to address these synchronization and timing behaviors.”

Thanks, Daryll

same here
Thanks for confirmation that it is ongoing on multiple customers