Using "Exclude specific alerts" in Analytic Rule Wizard not working

Question

Hi team,

We are using Sentinel to centralize all alerts from the different Azure Security solutions.

Because of that, sometimes we are receiving two alerts for the same behaviour and it's causing us alert fatigue.

I tried using the feature "Exclude specific alert" filter to avoid duplicates, using the name of the alert but they keep coming.

This is the filter im using

This is the summary of the Incident

Any recommendation would be helpful :)

Kind regards,

Answer 1

Do you have the Microsoft Defender 365 (M365D) connector enabled?

AAD Identity Protection alerts are sent to M365D automatically.

There is also an AAD-IP Connector and related Microsoft Security rule. Having both enabled will lead to duplicate alerts.

I don't believe there is a similar feature to filter the M365D alerts. You might consider using an automation rule to auto-close instead.

Answer 2

Hi Andrew,

Thank you for the reply.

In this case, and reviewing back this case. I figured out that I was writting "sing" instead of "sign" and that was causing the issue.

The problem is solved now.

Regards,