The closed Tickets are reopened in Microsoft sentinel automatically

Question

The closed Tickets are reopened in Microsoft sentinel automatically

Suprit Keste 0

In Microsoft sentinel some tickets are reopened automatically, and only same type of tickets are reopened and in the activity logs it is showing like: "Incident status was changed to New by Alert updated" can you tell me why?

Rukmini 25,320 Reputation points Microsoft External Staff Moderator

2026-01-21T13:30:13.25+00:00
Hey Suprit, it sounds like you’re facing an issue where certain tickets in Microsoft Sentinel are being reopened automatically. This can indeed be puzzling, especially when the activity logs indicate status changes triggered by alerts.

Here’s what you can consider:

Understanding Incident Lifecycle: In Microsoft Sentinel, an incident’s status can change based on alerts. If an alert is updated or re-triggered, it might automatically reopen a corresponding incident if it's classified as a new alert. This can happen if the detection logic indicates ongoing or similar issues that necessitate further investigation.

Classification Matters: When you close an incident, ensure that you specify an appropriate classification (True Positive, Benign Positive, False Positive, etc.). This may help the system understand how to handle similar alerts in the future.

Use of the Defender Portal: If you need more direct support regarding this issue, it's worth noting that Microsoft Sentinel's integration with Defender is evolving. Some features and support requests may only be fully available through the Defender portal.

Documentation: To read more on incident handling and integrations, check out the following resources:

Investigate cases in Microsoft Sentinel

Microsoft Defender XDR integration with Microsoft Sentinel

Transition your Microsoft Sentinel environment to the Defender portal

If your incidents are consistently reopening and it's becoming a nuisance, here are a few follow-up questions that could help narrow down the issue:

Are you noticing this behavior with specific types of alerts, or is it happening across all alerts?

Have you recently made changes to alert rules or configurations in Microsoft Sentinel that might affect incident handling?

Can you provide examples of the types of incidents that are being reopened?

Hope this helps you get to the bottom of that issue! Let me know if you need more assistance!

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Suprit Keste 0 Reputation points

2026-01-21T13:35:24.64+00:00

The alerts are Related to DLP and all are high tickets and one more thing is the tickets are reopened and assigned to the same people who have closed it before

Your answer

Suprit Keste 0 Reputation points

2026-01-21T13:35:24.64+00:00

The alerts are Related to DLP and all are high tickets and one more thing is the tickets are reopened and assigned to the same people who have closed it before

Share via

The closed Tickets are reopened in Microsoft sentinel automatically

Your answer