Permission required to reopen matching incident.

Question

Hello, i am configuring Analytic Rules in Sentinel and i am trying to perform alert grouping. From my understanding, the alert will only group on open incident. To add alerts into a closed incident, i must have the option “Re-open closed matching incidents”.

However, the option is currently greyed out for me. Checked that i have Security Administrator role and the Sentinel workspace is not connected to Microsoft Defender. What permission am i missing out to enable that option?

Answer 1

@syafiq Thank you for reaching out to us, review the RBAC permissions defined here - Microsoft Sentinel roles, permissions, and allowed actions as per this table Microsoft Sentinel Responder & Microsoft Sentinel Contributor role should help to achieve the above mentioned ask.

Reference: https://learn.microsoft.com/en-us/azure/sentinel/roles#role-and-permissions-recommendations:~:text=Microsoft%20Sentinel%20experience.-,Role%20and%20permissions%20recommendations,-After%20understanding%20how

Let me know if you have any further questions, feel free to post back.