I find the answer :
Defender 365 admin console - Disabled Connected to a custom indicator & Connected to a unsanctionned blocked app rules
I want to know how I can disable these two following alerts :
- Disabled Connected to a custom indicator
- Connected to an unsanctioned blocked app
I didn't find these alerts on the Alerts Policy of XDR/EPP or Cloud apps.
Since all the changed that Microsoft has done in the past few months, a lot of settings changed the place or are missing. Those alerts type needs to be enabled or disabled on demand, like the other alerts types..
7 answers
Sort by: Most helpful
-
-
Étienne Fiset 50 Reputation points
2024-06-19T19:36:11.75+00:00 I created in article in Techcommunity with solution : https://techcommunity.microsoft.com/t5/microsoft-defender-xdr/defender-365-admin-console-disabled-connected-to-a-custom/m-p/4171913
You can solved this discussion.
-
Catherine Kyalo 665 Reputation points Microsoft Employee
2024-04-04T10:12:52.8433333+00:00 Hi @Étienne Fiset
Based on my research, You can explore using Alert Suppression feature in Microsoft defender XDR. Below is a link that can guide on the process.
-
Étienne Fiset 50 Reputation points
2024-04-09T17:23:24.5566667+00:00 Please, vote for this Design change request : https://feedbackportal.microsoft.com/feedback/idea/f7a32d7d-7bf3-ee11-a73d-6045bd7e894e
-
Marilee Turscak-MSFT 36,861 Reputation points Microsoft Employee
2024-04-11T22:41:30.1366667+00:00 Hi @Étienne Fiset ,
I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.
Issue:
You wanted to disable these two alerts:
- Disabled Connected to a custom indicator
- Connected to an unsanctioned blocked app
Solution:
You cannot currently suppress an alert triggered by a "custom detection" source.
You filed a design change request here: https://feedbackportal.microsoft.com/feedback/idea/f7a32d7d-7bf3-ee11-a73d-6045bd7e894e
I have also filed an internal design change request on your behalf.
If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
- Disabled Connected to a custom indicator