Closure Comments getting wiped out from Sentinel Incidents

Shivthare, Tejaswi 0 Reputation points
2024-04-16T15:23:45.8633333+00:00

Hi,

We have observed that closure comments updated on sentinel incidents are getting wiped out after some time. This issue is observed for some of the alerts detected by Microsoft Defender. Only the closure classification remain in the incident activity log.

What could be the reason?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andrew Blumhardt 9,496 Reputation points Microsoft Employee
    2024-04-22T13:08:32.4466667+00:00

    I have not observed this behavior myself. I recommend capturing screen shots to reinforce your explanation. You may need to open a formal support request if this is a major issue.

    You can run an experiment to recreate the issue. Being able to reproduce the results will help to drive a solution. For example, make comments on an incident, wait a few minutes and close. Query to see the history.

    Consider that each change to the incident is represented as a new entry (row) in SecurityIncidents. These records are immutable, they do not change. So to make a change a new record is created. This history might provide some clues. It could be a bug in the Defender XDR alert connector.

    Based on what you shared. I would expect to see a final entry when the incident is closed and the comments array to be cleared or replaced with a final comment.

    SecurityIncident
| where IncidentNumber == 871842
    0 comments