Resolving Defender XDR Incident Correlation Missing Related Alerts: A Guide for SOC Analysts

Explore Our Microsoft Cloud Security Training →

Defender XDR (Extended Detection and Response) is a powerful tool that correlates alerts across multiple Microsoft security products. However, SOC analysts investigating multi-stage attacks may run into issues with correlated alerts that seem to be missing related events.

This guide provides solutions for these problems and optimizes incident correlation within Defender XDR. By understanding how XDR correlates alerts based on shared entities (user, device, mailbox, IP), verifying consistent naming across MDE, MDI, and MDCA, manually merging related incidents, implementing custom correlations via Advanced Hunting, and setting up custom detection rules with KQL queries, you can ensure that your investigations are as comprehensive as possible.

### How XDR Correlates Alerts Across Products

Defender XDR correlates alerts when they share entities (user, device, mailbox, IP). If an entity is present in multiple alerts but not correlated, it may indicate inconsistent naming or misconfigurations.

### Asset Linking Requirements

For devices, ensure that they are properly named consistently across MDE, MDI, and MDCA. For users, make sure the UPN is consistent and not affected by aliases or guest account scenarios.

### Manual Incident Merge and Split Operations

Manually merge related incidents from the Incidents page > Manage incident > Merge incidents. To split an incident, right-click on it and select “Split incident”.

### Custom Correlation via Advanced Hunting

Use Advanced Hunting to query AlertEvidence and AlertInfo tables. This allows for custom scenarios where alerts are not correlated by default.

### Time Window Considerations for Correlation

Correlating incidents across a wide time window can lead to false positives due to unrelated activities. Consider limiting the time frame for correlation to minimize these issues.

Explore Our Microsoft Cloud Security Training →