Microsoft Defender Indicator Rules

Question

Hello,

I created two indicator rules in the security center (security.microsoft.com) based on the file hash. I set the indicator action to allow but it still triggers events and e-mails. Should i create a addiontal alert supression regarding this file hashes?

Answer 1

@JohnSmith, Thanks for posting in Q&A. From your description, it seems the issue is with Microsoft Defender. To find the right support, you can contact the Defender support in the following link to get help:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.