question

MarileeTurscak avatar image
0 Votes"
MarileeTurscak asked ·

What are “Incidents” in Azure Sentinel and how are they different from alerts?

What does it mean when I see a list of new and open incidents in Azure Sentinel? What are incidents in Azure Sentinel and how are they different from alerts?

7916-incidents-sentinel.png

[Note: As we migrate from MSDN, this question has been posted by an Azure Cloud Engineer as a frequently asked question] Source: Azure Sentinel Overview


azure-sentinel
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

SaurabhSharma-msft avatar image
1 Vote"
SaurabhSharma-msft answered ·

Incidents are groups of related alerts that together create an actionable possible-threat that you can investigate and resolve. Azure Sentinel uses analytics to correlate alerts into incidents. Use the built-in correlation rules as-is, or use them as a starting point to build your own.
Azure Sentinel also provides machine learning rules to map your network behavior and then look for anomalies across your resources. These analytics connect the dots, by combining low fidelity alerts about different entities into potential high-fidelity security incidents.

Source: https://docs.microsoft.com/en-us/azure/sentinel/overview


· Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.