Skip to main content
{ Security Operations }

Microsoft Defender for Endpoint Alert Triage

Provides a ranked queue of open High and Medium Defender for Endpoint alerts with their age, ownership, recurring detections, and bursts.

What this agent does

This read-only agent reviews the open High and Medium alerts in Microsoft Defender for Endpoint. It ranks them by severity and age, and it flags alerts with no owner. It groups alerts that share a detection and finds bursts of the same alert.

The challenge

Defender raises alerts faster than a team can read them. The incident queue hides how old each alert is. A High alert from last week sits below a Medium alert from this morning. One noisy detection on a vulnerability scanner fills the queue in an hour. Analysts work the newest alert instead of the most urgent one.

The solution

The agent ranks the open High and Medium alerts, with High first and older alerts first. It measures age against advisory thresholds and never presents them as an organizational SLA. It shows recurring detections and bursts as tuning candidates, with the kind of change that would address each one, to enable defenders to work the oldest urgent alerts and cut repeated noise.

Workflow

  1. 01

    Read open alerts

    Read the open alerts from the last 90 days with their severity, created time, assignee, category, detection source, title, and technique.

  2. 02

    Rank

    Order High before Medium, then older before newer, and flag alerts past the advisory aging thresholds.

  3. 03

    Find patterns

    Group alerts by category, detection source, and technique to find recurring detections and hourly bursts.

  4. 04

    Report

    Publish the queue and pattern counts without alert titles, devices, users, or alert IDs.

Agent template 

# Microsoft Defender for Endpoint Alert Triage

## Measurable outcomes

Every open High and Medium Defender for Endpoint alert is in the ranked queue with its age and whether it has an owner. Track the aging, unowned, recurring, and burst counts on every run.

## Procedure

Read the open Defender for Endpoint alerts from the last 90 days, in the New and In Progress states. Rank High before Medium, then older before newer. Flag a High alert older than 24 hours and a Medium alert older than 72 hours, unless I supply our response SLAs. Call these thresholds advisory, never SLA breaches. Flag each High or Medium alert with no assignee. Treat alerts that share a category, detection source, and technique as one detection. Call a detection recurring when it has 3 or more open alerts. Call it a burst when 5 or more of its alerts arrive in the same hour. Present recurring detections and bursts as tuning candidates. For each candidate, name the kind of change that would address it. An alert suppression rule scoped to a device group is the narrowest change. An attack surface reduction rule exclusion is wider. An allow indicator for a file or certificate is the broadest, because it lets the file run on every device. Say what each change would hide.

## Requirements

It needs read access to Defender for Endpoint alerts, through an app registration with the Alert.Read.All permission, and nothing more. It never changes alert status, assignment, classification, suppression rules, indicators, or policy. Reports show categories, detection sources, techniques, and counts, with alert titles, devices, users, and alert IDs left out.