Azure Defender Out of the box Rule in Azure Sentinel

Question

Hi ,

May i know the difference between

1. Create incidents based on Azure Security Center alerts
2. Create incidents based on Azure Defender alerts

Both the Microsoft security service is shown as Azure Defender

Thanks in advance!

Answer 1

@Nafila Afrin Thanks for reaching out.

The first incident creation rule(Azure security center) is the old one that you see, that has been renamed with Azure Defender now.
The connector also now has the Azure Defender name updated and the same option will find while creating the analytics rules.

-----------------------------------------------------------------------------------------------------------------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.