You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/relate-alerts-to-incidents.md
+25-28Lines changed: 25 additions & 28 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,6 @@ author: yelevin
5
5
ms.topic: how-to
6
6
ms.date: 05/12/2022
7
7
ms.author: yelevin
8
-
ms.custom: ignite-fall-2021
9
8
---
10
9
11
10
# Relate alerts to incidents in Microsoft Sentinel
@@ -18,7 +17,7 @@ This article shows you how to relate alerts to your incidents in Microsoft Senti
18
17
> Incident expansion is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19
18
>
20
19
21
-
## Expand the scope and the power of incidents
20
+
## Expand the scope and power of your incidents
22
21
23
22
One thing that this feature allows you to do is to include alerts from one data source in incidents generated by another data source. For example, you can add alerts from Microsoft Defender for Cloud, or from various third-party data sources, to incidents imported into Microsoft Sentinel from Microsoft 365 Defender.
24
23
@@ -76,19 +75,21 @@ When adding an alert to an incident, depending on the circumstances, you might b
76
75
77
76
:::image type="content" source="media/relate-alerts-to-incidents/keep-or-close-other-incident.png" alt-text="Screenshot asking whether to keep or close other incident.":::
78
77
79
-
-**Keep other incident** preserves the alert in the other incident while also adding it to this one.
78
+
-**Keep other incident** preserves the other incident as is, while also adding the alert to this one.
80
79
81
-
-**Close other incident** adds the alert to this incident but removes it from the other incident, closing that incident in the process.
80
+
-**Close other incident** adds the alert to this incident and closes the other incident, adding the closing reason "Undetermined" and the comment "Alert was added to another incident" with the open incident's number.
82
81
83
-
-**Cancel** leaves the status quo. It keeps the alert in its original incident and does not add it to this one.
82
+
-**Cancel** leaves the status quo. It makes no changes to either the open incident or any other referenced incident.
84
83
85
84
Which of these options you choose depends on your particular needs; we don't recommend one choice over the other.
86
85
87
86
### Limitations
88
87
89
88
- Microsoft Sentinel imports both alerts and incidents from Microsoft 365 Defender. For the most part, you can treat these alerts and incidents like regular Microsoft Sentinel alerts and incidents.
90
89
91
-
However, you can only add Defender alerts to Defender incidents (or remove them) in the Defender portal, not in the Sentinel portal. If you try doing this in Microsoft Sentinel, you will get an error message. You can pivot to the incident in the Microsoft 365 Defender portal using the link in the Microsoft Sentinel incident.
90
+
However, you can only add Defender alerts to Defender incidents (or remove them) in the Defender portal, not in the Sentinel portal. If you try doing this in Microsoft Sentinel, you will get an error message. You can pivot to the incident in the Microsoft 365 Defender portal using the link in the Microsoft Sentinel incident. Don't worry, though - any changes you make to the incident in the Microsoft 365 Defender portal are [synchronized](microsoft-365-defender-sentinel-integration.md#working-with-microsoft-365-defender-incidents-in-microsoft-sentinel-and-bi-directional-sync) with the parallel incident in Microsoft Sentinel, so you'll still see the added alerts in the incident in the Sentinel portal.
91
+
92
+
You *can* add Microsoft 365 Defender alerts to non-Defender incidents, and non-Defender alerts to Defender incidents, in the Microsoft Sentinel portal.
92
93
93
94
- An incident can contain a maximum of 150 alerts. If you try to add an alert to an incident with 150 alerts in it, you will get an error message.
94
95
@@ -109,16 +110,15 @@ You're not limited to the portal to use this feature. It's also accessible throu
109
110
You add an alert to an incident by creating a relationship between them. Use the following endpoint to add an alert to an existing incident. After this request is made, the alert joins the incident and will be visible in the list of alerts in the incident in the portal.
110
111
111
112
```http
112
-
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/Incidents/{incidentId}/relations/{incidentId}_{SystemAlertId}?api-version=2019-01-01-preview
113
-
113
+
PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations/{relationName}?api-version=2021-10-01-preview
@@ -128,34 +128,31 @@ The request body looks like this:
128
128
You remove an alert from an incident by deleting the relationship between them. Use the following endpoint to remove an alert from an existing incident. After this request is made, the alert will no longer be connected to or appear in the incident.
You can also list all the alerts that are related to a particular incident, with this endpoint and request:
138
137
139
138
```http
140
-
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/Incidents/{incidentId}/relations?api-version=2019-01-01-preview
141
-
139
+
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/incidents/{incidentId}/relations?api-version=2021-10-01-preview
142
140
```
143
141
144
-
### Expected responses
145
-
146
-
Here are the possible response codes and results of these requests:
147
-
148
-
| Code | Response | Result of operation |
149
-
| ------- | ---------- | ------------------- |
150
-
|**204**| No content | Success |
151
-
|**400**| BadRequest | Failed to create relation. Different relation type with name {relationName} already exists in incident {incidentIdentifier}. |
152
-
|**400**| BadRequest | Failed to create relation. Alert {systemAlertId} already exists in incident {incidentIdentifier}. |
153
-
|**400**| BadRequest | Failed to create relation. Related resource and incident should belong to the same workspace. |
154
-
|**400**| BadRequest | Failed to create relation. Microsoft 365 Defender alerts cannot be added to Microsoft 365 Defender incidents. |
155
-
|**400**| BadRequest | Failed to delete relation. Microsoft 365 Defender alerts cannot be removed from Microsoft 365 Defender incidents. |
156
-
|**409**| Conflict | Failed to create relation. Relation with name {relationName} already exists in incident {incidentIdentifier} to different alert {relationAlertId}. |
157
-
|**404**| Not found | Resource '{alertId}' does not exist. |
158
-
|**404**| Not found | Incident doesn’t exist. |
142
+
### Specific error codes
143
+
144
+
The [general API documentation](/rest/api/securityinsights/preview/incident-relations) lists expected response codes for the [Create](/rest/api/securityinsights/preview/incident-relations/create-or-update#response), [Delete](/rest/api/securityinsights/preview/incident-relations/delete#response), and [List](/rest/api/securityinsights/preview/incident-relations/list#response) operations mentioned above. Error codes are only mentioned there as a general category. Here are the possible specific error codes and messages listed there under the category of "Other Status Codes":
|**400 Bad Request**| Failed to create relation. Different relation type with name {relationName} already exists in incident {incidentIdentifier}. |
149
+
|**400 Bad Request**| Failed to create relation. Alert {systemAlertId} already exists in incident {incidentIdentifier}. |
150
+
|**400 Bad Request**| Failed to create relation. Related resource and incident should belong to the same workspace. |
151
+
|**400 Bad Request**| Failed to create relation. Microsoft 365 Defender alerts cannot be added to Microsoft 365 Defender incidents. |
152
+
|**400 Bad Request**| Failed to delete relation. Microsoft 365 Defender alerts cannot be removed from Microsoft 365 Defender incidents. |
153
+
|**404 Not found**| Resource '{systemAlertId}' does not exist. |
154
+
|**404 Not found**| Incident doesn’t exist. |
155
+
|**409 Conflict**| Failed to create relation. Relation with name {relationName} already exists in incident {incidentIdentifier} to different alert {systemAlertId}. |
159
156
160
157
## Next steps
161
158
In this article, you learned how to add alerts to incidents and remove them using the Microsoft Sentinel portal and API. For more information, see:
Copy file name to clipboardExpand all lines: articles/sentinel/whats-new.md
+13-5Lines changed: 13 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,16 +29,24 @@ If you're looking for items older than six months, you'll find them in the [Arch
29
29
30
30
## May 2022
31
31
32
-
-[Relate alerts to incidents](#relate-alerts-to-incidents)
33
-
-[Similar incidents](#similar-incidents)
32
+
-[Relate alerts to incidents](#relate-alerts-to-incidents-preview)
33
+
-[Similar incidents](#similar-incidents-preview)
34
34
35
-
### Relate alerts to incidents
35
+
### Relate alerts to incidents (Preview)
36
36
37
-
### Similar incidents
37
+
You can now add alerts to, or remove alerts from, existing incidents, either manually or automatically, as part of your investigation processes. This allows you to refine the incident scope as the investigation unfolds. For example, relate Microsoft Defender for Cloud alerts, or alerts from third-party products, to incidents synchronized from Microsoft 365 Defender. Use this feature from the investigation graph, the API, or through automation playbooks.
38
38
39
-
## April 2022
39
+
Learn more about [relating alerts to incidents](relate-alerts-to-incidents.md).
40
40
41
+
### Similar incidents (Preview)
41
42
43
+
When triaging or investigating an incident, the context of the entirety of incidents in your SOC can be extremely useful. For example, other incidents involving the same entities can represent useful context that will allow you to reach the right decision faster. Now there's a new tab in the incident page that lists other incidents that are similar to the incident you are investigating. Some common use cases for using similar incidents are:
44
+
45
+
- Finding other incidents that might be part of a larger attack story.
46
+
- Using a similar incident as a reference for incident handling. The way the previous incident was handled can act as a guide for handling the current one.
47
+
- Finding relevant people in your SOC that have handled similar incidents for guidance or consult.
48
+
49
+
Learn more about [similar incidents](investigate-cases.md#similar-incidents-preview).
0 commit comments