Choose Defender alert tuning actions with the retained evidence location in view

Source facts

Hide suppresses an alert and incident creation while retaining data in AlertInfo and AlertEvidence; Microsoft limits it to Defender for Endpoint alerts. Resolve generates matching alerts and associated incidents in a resolved state. Set as behavior keeps the signal outside the alert queue and incidents, retaining hunting data in BehaviorInfo and BehaviorEntities; Defender for Cloud and Defender for Office 365 alerts do not support that action. Microsoft Learn.

Applicability

Use this comparison for an approved Microsoft Defender alert-tuning change. Identify the producing service first and select only an action that the current documentation supports for that source.

DSE recommendation

DSE recommends documenting both the desired queue outcome and the evidence location before approving a tuning rule. Give the SOC owner a concrete statement of which signals remain reviewable and where. Keep the rule narrowly scoped to the expected activity and schedule an explicit review of its matches.

Verification

In an approved test, compare the queue outcome and hunting record with the chosen action. Confirm that the investigation procedure can find the retained signal. Record the producing service, matching conditions and observed result before expanding the rule.

Official references

Microsoft Learn: Investigate alerts in Microsoft Defender XDR. Source reviewed September 17, 2026.