{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "slug": "dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view", "url": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/" }, "title": "Choose Defender alert tuning actions with the retained evidence location in view", "summary": "How do Hide, Resolve and Set as behavior differ when tuning a Defender alert?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:41+00:00", "modified_at": "2026-09-17T16:38:45+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 200, "potentially_affected": "Use this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.", "dse_recommendation": "DSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule.", "primary_source": { "name": "Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Hide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. Microsoft Learn.

\n

Applicability

\n

Use this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.

\n

DSE recommendation

\n

DSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.

\n

Verification

\n

In an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.

\n

Official references

\n

Microsoft Learn: Investigate alerts in Microsoft Defender XDR. Source reviewed September 17, 2026.

", "content_text": "Source facts\nHide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. Microsoft Learn.\nApplicability\nUse this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.\nDSE recommendation\nDSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.\nVerification\nIn an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.\nOfficial references\nMicrosoft Learn: Investigate alerts in Microsoft Defender XDR. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nHide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts).\n\n## Applicability\n\nUse this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.\n\n## DSE recommendation\n\nDSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.\n\n## Verification\n\nIn an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.\n\n## Official references\n\n[Microsoft Learn: Investigate alerts in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "url": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose Defender alert tuning actions with the retained evidence location in view", "item": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "url": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/", "headline": "Choose Defender alert tuning actions with the retained evidence location in view", "description": "How do Hide, Resolve and Set as behavior differ when tuning a Defender alert?", "abstract": "How do Hide, Resolve and Set as behavior differ when tuning a Defender alert?", "articleBody": "Source facts\nHide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. Microsoft Learn.\nApplicability\nUse this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.\nDSE recommendation\nDSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.\nVerification\nIn an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.\nOfficial references\nMicrosoft Learn: Investigate alerts in Microsoft Defender XDR. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:33:41+00:00", "dateModified": "2026-09-17T16:38:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose Defender alert tuning actions with the retained evidence location in view" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 200, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts" } } ] } }