Defender XDR Feature Request - Add startswith/endswith comparator to alert tuning rules

Question

I had to set up a Defender XDR (specifically Defender for Endpoint) alert tuning rule today for a local repository mirror, which clones repositories to make them available to airgapped devices. Defender detects some of these as malware (such as aircrack-ng, which is in the debian default repository).

I created a suppressions rule for when a file contains amd64.deb to filter out package files vs execution of tools. It would work much better if I could use an endswith operator. There are no false positives but I imagine it would be an easy feature to implement and there will be other use cases, such as filetype tuning.

Answer 1

Defender XDR alert tuning currently supports conditions where values “aren't case sensitive, and some properties support wildcards.” This allows matching patterns like substrings or simple wildcard expressions, but there is no documented support for explicit startswith or endswith comparators in alert tuning rules.

For scenarios like filtering .deb packages (for example, *.amd64.deb), the recommended approach is to use the existing wildcard capability on the relevant evidence property (for example, file name or path) in the Conditions area of the Tune alert pane. Conditions can be combined with AND/OR and grouping to refine matching logic.

To request startswith/endswith operators as a product enhancement, the appropriate path is to submit feedback through the Microsoft Defender portal (Feedback or Help → Give feedback) or via the usual Microsoft support and feedback channels used by the organization. This ensures the feature request is tracked by the Defender product team.

---

References:

• Investigate alerts in Microsoft Defender XDR
• Address false positives/negatives in Microsoft Defender for Endpoint
• Alert policies in the Microsoft Defender portal
• Automated investigation and response (AIR) in Microsoft Defender for Office 365 Plan 2