Question

A security analyst at Contoso opens an incident in the Microsoft Defender portal that groups five related alerts across email and endpoint. She confirms the activity is expected behavior from an approved internal penetration test. She wants to close the entire incident so that all associated alerts are resolved together and future identical alerts are suppressed from generating new incidents. Which combination of actions in the Defender portal should she take?

Accepted Answer

Set the incident classification to Benign positive - Security testing, resolve the incident, and create a tuning/suppression rule for the alert type

Answer

Set the incident classification to False positive - Not malicious and delete each alert individually from the alert queue

Answer

Change the incident status to In progress and add the pen-test tool's IP to the Tenant Allow/Block List

Answer

Reassign the incident to the SOC lead and mark each alert as True positive to preserve the audit trail