Question

A financial services company runs Microsoft Sentinel integrated with Defender XDR. The SOC receives thousands of low-severity alerts daily, mostly benign sign-ins from known corporate egress IPs, plus a smaller volume of high-severity incidents requiring analyst investigation. Leadership wants to reduce analyst fatigue while ensuring genuine threats are never auto-closed, and they require an auditable record of every automated decision. As the security architect, which SOAR design should you recommend?

Accepted Answer

Create Sentinel automation rules that auto-close incidents matching the benign known-IP pattern with a tagged closing reason, and trigger playbooks for enrichment and analyst notification only on high-severity incidents.

Answer

Configure a single Logic App playbook that runs on every incoming incident to close it automatically, relying on analysts to reopen anything that was misclassified.

Answer

Raise the alert threshold in Defender XDR so low-severity sign-in alerts are never generated, eliminating the noise at the source.

Answer

Disable analytics rules that produce the benign sign-in alerts and manually review Entra ID sign-in logs weekly for anomalies.