# Choose Defender alert tuning actions with the retained evidence location in view

> How do Hide, Resolve and Set as behavior differ when tuning a Defender alert?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:41+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How do Hide, Resolve and Set as behavior differ when tuning a Defender alert?

## Potentially affected

Use this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.

## DSE recommendation

DSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule.

## Article

## Source facts

Hide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts).

## Applicability

Use this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.

## DSE recommendation

DSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.

## Verification

In an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.

## Official references

[Microsoft Learn: Investigate alerts in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts). Source reviewed September 17, 2026.

## Primary reference

- Name: Investigate alerts in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose Defender alert tuning actions with the retained evidence location in view,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-079-choose-defender-alert-tuning-actions-with-the-retained-evidence-location-in-view/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.