Defender 365 admin console - Disabled Connected to a custom indicator & Connected to a unsanctionned blocked app rules

Étienne Fiset 50 Reputation points
2024-03-21T14:28:41.46+00:00

I want to know how I can disable these two following alerts :

  1. Disabled Connected to a custom indicator
  2. Connected to an unsanctioned blocked app

I didn't find these alerts on the Alerts Policy of XDR/EPP or Cloud apps.

Since all the changed that Microsoft has done in the past few months, a lot of settings changed the place or are missing. Those alerts type needs to be enabled or disabled on demand, like the other alerts types..

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps
A Microsoft cloud access security broker that enables customers to control the access and use of software as a service apps in their organization.
118 questions

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Étienne Fiset 50 Reputation points
    2024-04-25T18:15:54.0566667+00:00

    Hey Guys,

    I'm working on a solution, if that's working as expected, I will post it here :)

    Thanks

    0 comments
  2. Étienne Fiset 50 Reputation points
    2024-05-30T15:10:47.2666667+00:00

    So i found a Quick Workaround that is working good for me right now. You have different options to doing it. However here's the solution :

    Steps to Automate Alert Management

    • Create a NRT (Near-Real Time) Rule in Sentinel:
    • Configure a detection rule that runs in near real-time to detect the specific alerts you want to manage.

    Create an Automation Rule:

    • Define an automation rule in Microsoft Sentinel that triggers when an alert matching your NRT rule is generated. You can also create an incident to group alerts if needed.

    Trigger a Logic App Playbook:

    • Set this automation rule to run a Logic App playbook when the alerts are generated. This playbook can be configured to perform various actions on the alerts.

    Configuring the Logic App Playbook

    Retrieve Alerts:

    • Use an action in the playbook to call the Sentinel API and retrieve the details of the alerts triggered by the automation rule.

    Change Alert Status:

    • Add an action in the playbook to update the status of the retrieved alerts to “Resolved”. This can be done using either the Microsoft Sentinel API or the Microsoft Defender for Endpoint (WindowsDefenderATP) API.

    API Integration Options

    Microsoft Sentinel API:

    • Use built-in Sentinel actions in Logic Apps to interact directly with alerts and incidents in Sentinel.

    Microsoft Defender for Endpoint (WindowsDefenderATP) API:

    • You can also use this API to manage alerts. Refer to the documentation for details on the necessary API calls: Microsoft Defender for Endpoint API.

    Summary of Actions

    • Automate Closing Alerts: Create an automated playbook in Sentinel to automatically close alerts.
    • Bidirectional Management: With SIEM integration in the Defender portal, you can manage incidents and alerts in both directions (from Sentinel to Defender and vice versa).
    0 comments