Defender XDR: Tune Your Alerts

Why alert tuning matters

Email notifications

Defender XDR sends three types of email notifications:

1. Incident notifications

Notify specific people or groups when new incidents are created.

Configuration	Options
Recipients	Email addresses (individuals, distribution groups, mail-enabled security groups)
Severity filter	High, Medium, Low, Informational (select one or more)
Device group filter	Notify only for incidents involving specific device groups
Service source	Filter by product (MDE, MDO, MDI, MDCA)

2. Action notifications

Notify when automated investigation and response (AIR) completes an action — remediation succeeded, pending approval, or failed.

3. Threat analytics notifications

Notify when Microsoft publishes new threat analytics reports — intelligence on emerging threats, campaigns, and vulnerabilities.

💡 Scenario: James configures notifications for Pacific Meridian

James at Pacific Meridian sets up tiered notifications:

• SOC team (all analysts) → High-severity incidents from all products
• Security leads (James + Sarah) → High and Medium severity + all AIR actions needing approval
• CISO → Threat analytics reports only (strategic awareness, not operational noise)
• Server team → Incidents involving the “Servers” device group only

This ensures the right people see the right alerts without everyone getting everything.

Alert suppression rules

Suppression rules automatically handle alerts that are known false positives or expected behaviour. Instead of analysts manually closing the same alert 50 times a day, a suppression rule does it automatically.

What you can suppress on

Criteria	Example
Alert title	Suppress “Suspicious PowerShell command line” when it matches a known admin script
MITRE ATT&CK technique	Suppress all T1059 (Command and Scripting Interpreter) alerts from a specific device group
Device group	Suppress certain alerts from the “Build Servers” group (expected CI/CD behaviour)
User	Suppress alerts from a service account that performs automated tasks
File hash/name	Suppress alerts triggered by a known-good executable

Suppression actions

Action	What Happens
Hide alert	Alert is created but hidden from the queue — still searchable in Advanced Hunting
Resolve alert	Alert is automatically marked as resolved with a chosen classification

💡 Exam tip: suppression vs tuning vs disabling

The exam distinguishes between:

• Suppression rules — auto-resolve or hide specific alerts matching criteria. The detection still runs; the alert is just handled automatically.
• Alert tuning (classification) — change the severity or classification of an alert type (true positive, false positive, benign true positive). Adjusts how analysts prioritise, not whether the alert fires.
• Disabling a detection — turns off the analytics rule or detection entirely. This is rarely the right answer because you lose visibility.

If a question asks “how to reduce noise from a known-safe activity,” the answer is usually suppression rule, not disabling the detection.

Alert correlation

Defender XDR automatically correlates alerts into incidents. Multiple related alerts become a single incident instead of separate items in the queue.

How correlation works

Defender XDR groups alerts when they share:

• Entity overlap — same device, user, mailbox, or IP address
• Time proximity — alerts occurring within a defined window
• Attack chain logic — alerts that fit a known attack pattern (e.g., phishing email → credential compromise → lateral movement)

This correlation is platform-driven — Defender XDR handles it automatically based on its AI engine. You do not directly configure correlation rules or thresholds. However, you influence correlation indirectly through:

• Entity mapping in custom detections and analytics rules (better mapping = better correlation)
• Alert tuning (suppressing false positives means cleaner correlation)
• Automated investigation triggers — which alert severities automatically start an investigation

Suppression removes noise; correlation organises what remains

Feature	Alert Suppression	Alert Correlation
Purpose	Remove known false positives from the queue	Group related alerts into a single incident
Reduces alert count?	Yes — alerts are hidden or auto-resolved	Yes — 15 related alerts become 1 incident
Detection still runs?	Yes — the detection fires, but the alert is handled	Yes — each alert still fires, they're just grouped
Configurable by	Alert title, MITRE technique, device group, user, file	Entity overlap, time window, attack chain logic
Who manages it	SOC analysts and leads create rules for known FPs	Mostly automatic; settings adjusted by SOC leads

💡 Scenario: Anika reduces alert volume for a client

One of Anika’s MSSP clients at Sentinel Shield generates 200+ alerts per day. After analysis:

• 60 alerts/day are PowerShell script executions from a known admin tool → Anika creates a suppression rule matching the script hash
• 40 alerts/day are 15 related alerts from the same phishing campaign → already handled by correlation (grouped into ~3 incidents)
• 30 alerts/day are low-severity informational alerts → Anika adjusts email notifications to exclude Informational severity

Result: the analyst queue drops from 200+ to ~70 actionable items per day. Detection coverage is unchanged.

Question

What are the three types of email notifications in Defender XDR?

Click or press Enter to reveal answer

Answer

1. Incident notifications — new incidents by severity, device group, and product. 2. Action notifications — automated investigation results (success, pending, failed). 3. Threat analytics notifications — new Microsoft threat reports.

Click to flip back

Question

What is the difference between suppressing an alert and disabling a detection?

Click or press Enter to reveal answer

Answer

Suppression: the detection still runs, and the alert is created but automatically hidden or resolved based on criteria. Disabling: the detection rule is turned off entirely, and no alerts are generated. Suppression preserves visibility; disabling removes it.

Click to flip back

Question

How does Defender XDR correlate alerts into incidents?

Click or press Enter to reveal answer

Answer

By entity overlap (same device, user, mailbox, IP), time proximity (alerts within a time window), and attack chain logic (alerts fitting known attack patterns like phishing → credential theft → lateral movement).

Click to flip back

Knowledge Check

Anika's SOC team at Sentinel Shield receives 60 alerts per day from a known-safe admin PowerShell script. What is the best way to handle this?

ADisable the PowerShell detection rule entirelyBAsk the admin to stop using PowerShellCCreate a suppression rule matching the script's file hash to auto-resolve those alertsDIncrease the alert severity to High so analysts prioritise them faster

Check Answer

Knowledge Check

James at Pacific Meridian wants his CISO to receive emails about emerging threat campaigns but NOT about individual incidents. Which notification type should he configure?

AIncident notifications filtered to High severity onlyBAction notifications for automated investigation resultsCThreat analytics notificationsDAlert suppression rules with email forwarding

Check Answer

Next up: Alerts are tuned. Now let’s automate the response — Automated Investigation and Response (AIR) handles the heavy lifting so your analysts can focus on what matters.