Added "determination" back to criteria

Author: yelevin

defender-xdr/alerts-incidents-correlation.md

@@ -85,7 +85,7 @@ Even when the correlation logic indicates that two incidents should be merged, D
 
 - One of the incidents has a status of "Closed". Incidents that are resolved don't get reopened.
 - The source and target incidents are assigned to two different people.
-- The source and target incidents have two different classifications (for example, true positive and false positive).
+- The source and target incidents have two different classifications (for example, true positive and false positive) or two different determinations (the subcategories of classifications).
 - Merging the two incidents would raise the number of entities in the target incident above the allowed maximum.
 - The two incidents contain devices in different [device groups](/defender-endpoint/machine-groups) as defined by the organization. <br>(This condition is not in effect by default; it must be enabled.)
 
@@ -95,12 +95,6 @@ If two incidents should be merged, but aren't merged for any of the reasons list
 
 For example, if the incidents weren't merged because they were assigned to two different people, you can remove the assignment of one of the incidents and then merge the incidents manually.
 
-<!-- This paragraph (what I originally wrote) better describes the Cases feature, doesn't it? 
-
-Over the course of investigating an incident, you might discover that other incidents are related to the same attack story or security event, and that these incidents should be investigated together as a unit. In such a case, you can now merge these incidents together into a single incident. This scenario includes cases where the incidents ought to be merged, but weren't because of the circumstances described previously in [When incidents aren't merged](#when-incidents-arent-merged).
-
--->
-
 Merging incidents together is preferable to unlinking alerts from one incident and linking them to another, because all the incident information (for example, the activity log) is preserved.
 
 For now, only two incidents at a time can be merged manually.

defender-xdr/merge-incidents-manually.md

@@ -30,7 +30,7 @@ Sometimes, however, the automatic merging doesn't happen, due to certain conditi
 
 - Users must have permissions to view the incidents queue.
 - Users must have read and write permissions on all the incidents they wish to merge. Incidents from different sources have different RBAC roles defined.
-- Incidents that are candidates for merging must have the same values for **Assigned to**, **Classification**, and **Determination**.
+- Incidents that are candidates for merging must have either the same values as each other, or null values, for the **Assigned to**, **Classification**, and **Determination** fields.
 
 ## Merge incidents from the incident queue page
 
@@ -50,7 +50,7 @@ Sometimes, however, the automatic merging doesn't happen, due to certain conditi
 
 1. In the confirmation dialog that appears, select **Merge**. When the merge is complete, a "Success" notification appears, with a link to follow to go to the merged (target) incident.
 
-    If the merge fails, a dialog box appears with a message that the incidents failed to merge. Verify that both incidents have the same values for **Assigned to**, **Classification**, and **Determination**.
+    If the merge fails, a dialog box appears with a message that the incidents failed to merge. Verify that both incidents have the same values, or that at least one of the incidents has a null value, for **Assigned to**, **Classification**, and **Determination**.
 
 ## Merge incidents from within the incident page
 
@@ -70,7 +70,7 @@ Sometimes, however, the automatic merging doesn't happen, due to certain conditi
 
 1. In the confirmation dialog that appears, select **Merge**. When the merge is complete, a "Success" notification appears, the open incident is closed, and you are redirected to the merged (target) incident.
 
-    If the merge fails, a dialog box appears with a message that the incidents failed to merge. For the merge to succeed, both incidents must have the same values for **Assigned to**, **Classification**, and **Determination**.
+    If the merge fails, a dialog box appears with a message that the incidents failed to merge. For the merge to succeed, both incidents must have the same values—or at least one incident must have a null value—for **Assigned to**, **Classification**, and **Determination**.
 
 ## Notes