Incidents in Microsoft Sentinel Auto-Closing Without Automation Rules

Question

I'm currently using Microsoft Sentinel and noticing that some incidents are automatically closing themselves, sometimes with the reason "resolved at source" or no comment at all. I've checked for any automation rules or playbooks that might be responsible, but I haven't found any. I suspect something in the Security portal might be causing this, but I'm not sure where to look.

Does anyone know the reason for this? There are several incidents like this, most of them related to "unfamiliar sign-in properties."

Answer 1

Hello @Hyago Santana Mariano,

Thank you for posting your query on Microsoft Q&A.

Based on your description, it appears that incidents in Microsoft Sentinel are being automatically closed with the “Reason for closing” set to “Benign positive – suspicious but expected. Resolved at source.” This behavior occurs when user risks are dismissed due to actions taken by the user, such as completing Multi-Factor Authentication (MFA) or resetting their password. When users are allowed to self-remediate using Microsoft Entra Multi-Factor Authentication (MFA) or Self-Service Password Reset (SSPR) within risk policies, they can unblock themselves when risk is detected.

Reference: Self-Remediation with Risk Policy

Identity Protection risks can often be detected and remediated automatically, without the need for intervention by an admin or security analyst. This self-remediation is a designed feature of Identity Protection. For more details on the self-remediation actions, please check the "Risky sign-ins" blade under Identity Protection in Entra ID, where you’ll find that, in most cases, MFA has remediated the risks.

As these risks are being automatically remediated in Entra Identity Protection, the related incidents triggered in Microsoft Sentinel are being closed automatically with the reason “Benign positive – suspicious but expected. Resolved at source.”

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.