List Automatically Closed Incidents

SecurityIncident | where ProviderName == "Microsoft 365 Defender" and ModifiedBy == "Microsoft 365 Defender" | extend OwnerObjectID = tostring(Owner.objectId) | where Status == "Closed" and Classification == "Undetermined" | where isempty(OwnerObjectID) | where isnotempty(ClassificationComment)

Query Information

Description

List the incidents that are automatically closed by Microsoft Defender XDR. It is good practice to get an overview of the automatically closed incidents and review them once every x period to determine if all the risks have been covered. The amount of automatically closed incidents depend on the Automation levels in automated investigation and remediation capabilities that are set in your tenant.

References

Explanation

This query is designed to list incidents that have been automatically closed by Microsoft Defender XDR (part of Microsoft 365 Defender). Here's a simple breakdown of what the query does:

Data Source: It looks at security incidents recorded in the system.
Provider Filter: It specifically filters for incidents handled by "Microsoft 365 Defender."
Modification Filter: It checks that these incidents were modified (closed) by "Microsoft 365 Defender" itself, indicating an automatic process.
Status and Classification: It focuses on incidents that are marked as "Closed" and have a classification of "Undetermined," meaning the system couldn't definitively categorize the incident.
Owner Check: It ensures that these incidents do not have an assigned owner, which further suggests they were automatically processed.
Comment Check: It includes only those incidents that have a classification comment, providing some context or reasoning for the closure.

In summary, this query helps you review incidents that were automatically closed by Microsoft Defender XDR, ensuring you can assess whether the automation is effectively managing risks.

KQL Search