Defender 365 admin console - Disabled Connected to a custom indicator & Connected to a unsanctionned blocked app rules

Étienne Fiset 45 Reputation points
2024-03-21T14:28:41.46+00:00

I want to know how I can disable these two following alerts :

  1. Disabled Connected to a custom indicator
  2. Connected to an unsanctioned blocked app

I didn't find these alerts on the Alerts Policy of XDR/EPP or Cloud apps.

Since all the changed that Microsoft has done in the past few months, a lot of settings changed the place or are missing. Those alerts type needs to be enabled or disabled on demand, like the other alerts types..

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,201 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
104 questions

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Étienne Fiset 45 Reputation points
    2024-04-04T15:08:24.1766667+00:00

    I find the answer :

    User's image

    1 person found this answer helpful.
  2. Catherine Kyalo 570 Reputation points Microsoft Employee
    2024-04-04T10:12:52.8433333+00:00

    Hi @Étienne Fiset

    Based on my research, You can explore using Alert Suppression feature in Microsoft defender XDR. Below is a link that can guide on the process.

    https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-suppression-rules?view=o365-worldwide

    User's image

  3. Étienne Fiset 45 Reputation points
    2024-04-09T17:23:24.5566667+00:00
  4. Marilee Turscak-MSFT 33,951 Reputation points Microsoft Employee
    2024-04-11T22:41:30.1366667+00:00

    Hi @Étienne Fiset ,

    I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

    Issue:

    You wanted to disable these two alerts:

    1. Disabled Connected to a custom indicator
      1. Connected to an unsanctioned blocked app

    Solution:

    You cannot currently suppress an alert triggered by a "custom detection" source.

    You filed a design change request here: https://feedbackportal.microsoft.com/feedback/idea/f7a32d7d-7bf3-ee11-a73d-6045bd7e894e

    I have also filed an internal design change request on your behalf.

    If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments
  5. Étienne Fiset 45 Reputation points
    2024-04-25T18:15:54.0566667+00:00

    Hey Guys,

    I'm working on a solution, if that's working as expected, I will post it here :)

    Thanks

    0 comments