Merge pull request #5818 from MicrosoftDocs/main

[AutoPublish] main to live - 12/02 07:34 PST | 12/02 21:04 IST

Author: m365-skilling-repo-management[bot]

defender-xdr/advanced-hunting-link-to-incident.md

@@ -9,7 +9,7 @@ f1.keywords:
 ms.author: pauloliveria
 author: poliveria
 ms.localizationpriority: medium
-manager: dansimp
+manager: orspodek
 audience: ITPro
 ms.collection: 
   - m365-security
@@ -22,7 +22,7 @@ appliesto:
     - Microsoft Defender XDR
     - Microsoft Sentinel in the Microsoft Defender portal
 ms.topic: how-to
-ms.date: 03/28/2025
+ms.date: 12/02/2025
 ---
 
 # Link query results to an incident
@@ -32,7 +32,11 @@ ms.date: 03/28/2025
 
 
 
-You can use the link to incident feature to add advanced hunting query results to a new or existing incident under investigation. This feature helps you easily capture records from advanced hunting activities, which enables you to create a richer timeline or context of events regarding an incident. 
+Use the link to incident feature to add advanced hunting query results to a new or existing incident under investigation. This feature helps you easily capture records from advanced hunting activities, which enables you to create a richer timeline or context of events regarding an incident. 
+
+## Required permissions for linking incidents 
+
+To link query results to an incident, you need the same permissions required for managing custom detections. For more information, see [Create custom detection rules](custom-detection-rules.md#required-permissions-for-managing-custom-detections).
 
 ## Link results to new or existing incidents
 
@@ -95,7 +99,7 @@ You can use the link to incident feature to add advanced hunting query results t
 7. Review the details you've provided in the Summary section. 
 8.	Select **Done**.
 
-### View linked records in the incident
+## View linked records in the incident
 
 You can select the generated link from the summary step of the wizard or select the incident name from the incident queue, to view the incident to which the events are linked.
 
@@ -108,7 +112,7 @@ You can also select the event from the timeline view or from the query results v
 
 :::image type="content" source="/defender/media/advanced-hunting-results-link8.png" alt-text="Screenshot of the incident page in the Microsoft Defender portal." lightbox="/defender/media/advanced-hunting-results-link8.png":::
 
-### Filter for events added using advanced hunting
+## Filter for events added using advanced hunting
 
 You can view which alerts were generated from advanced hunting by filtering incidents and alerts by **Manual** detection source.