Hey ​@0xM4XDF1R ,

For this use case, you would need to create a Job. Jobs are designed to synchronize Google SecOps with 3rd party products. You can take the inspiration from our Sample Integration, here is the related guide for it.

But we do plan to have an official job for M365 Defender in Q4 2025/Q1 2026. I will take it internally to see, if it can be done sooner than later.

 Hey ​@0xM4XDF1R ,

We’re using a custom job in our environment. You’re going to need to lean on the Defender XDR APIs and the Siemplify SDK for case manipulation.

Unfortunately I can’t send you the raw python code at present but fundamentally you want to achieve this logic -

• Setup your Defender XDR API authentication using your App registration or a new one specifically for this job - https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/microsoft-365-defender#before_you_begin
• Create a new custom integration and a new custom job within it to execute the python - https://cloud.google.com/chronicle/docs/soar/respond/start-developing/my-first-integration - https://cloud.google.com/chronicle/docs/soar/reference/siemplify-job-module - https://github.com/chronicle/soar-sdk
• Get recently resolved incidents - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents
• Search for cases using those incident IDs (we used to use tags but I believe ‘ticketId’ is a field that is populated on an alert beneath a Defender case) - You can get cases by a filter with - get_cases_ids_by_filter (useful to filter out simulated cases) - and then get alert details beneath those cases to grab the alerts that have the ticketId == incidentId.
• Close those alerts (and ultimately the parent case) - siemplify.close_alert()
• Proceed to do the reverse for recently closed cases sourced from Defender.

There’s some neat translation you can do between closure reasons too to ensure both Defender and SecOps have the correct classifications.

Sorry its not as simple as a cut and paste solution for you right now, I had a hell of a time with this way back so know the pain.

It’s positive news that an officially support job might be on the way!