Microsoft 365 Defender Asset Rules and Alert Tuning Explained
Question details
Understand how asset rules and alert-tuning rules function in Microsoft 365 Defender to better manage alert generation and focus on relevant threats.
- Product
- Microsoft 365 Defender
- Device & OS
- not provided
- Scenario
- Configuring security settings to reduce alert fatigue and focus administrative investigations on high-priority security threats.
- Observed behavior
- The user needs to streamline security alerts by utilizing asset rules and alert tuning to filter out irrelevant notifications and false positives.
Ensure you have the necessary administrative privileges (such as Security Administrator or Global Administrator) in your Microsoft 365 tenant to access and modify Defender settings.
Review and Configure Alert Tuning Rules in Microsoft 365 Defender
Use alert tuning rules to automatically resolve or hide alerts that match specific conditions, effectively reducing alert fatigue for your security operations team.
Alert tuning helps security operations teams by automatically resolving false positives or expected informational alerts. By fine-tuning these rules, you can ensure that only actionable threats are escalated, saving time and improving incident response efficiency.
Log in to the Microsoft 365 Defender portal at security.microsoft.com using an administrator account.
In the left navigation pane, scroll down to 'Settings', select 'Endpoints', and then choose 'Alert tuning' under the Rules section.
Click the 'Add new rule' button to define the conditions for alerts you want to suppress or automatically resolve.
Fill in the required rule criteria, such as specific threat indicators, file hashes, or user conditions, choose the action (e.g., hide or resolve), and save the rule.
Looking for a simpler, cost-effective office suite? Try WPS Office
While Microsoft 365 Defender is essential for enterprise security management, maintaining expensive Microsoft 365 enterprise licenses just for document editing may be unnecessary for everyone. WPS Office offers a free, lightweight, and highly compatible alternative for your daily productivity needs.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer for your specific operating system.
- 2. Install WPS Office: Run the setup file and follow the on-screen instructions to complete the lightweight installation.
- 3. Open Your Office Documents: Launch WPS Office and instantly open your existing .docx, .xlsx, or .pptx files with full formatting compatibility.
Frequently Asked Questions
What is the main purpose of alert tuning in Microsoft 365 Defender?
Alert tuning is designed to reduce alert fatigue for security operations teams by automatically hiding or resolving alerts that are known false positives or low-priority informational events.
Who has permission to create alert tuning rules?
Only users with specific administrative roles, such as Security Administrator or Global Administrator, have the permissions required to view, create, or modify alert tuning rules within the Microsoft 365 Defender portal.
Do alert tuning rules delete the triggered alerts completely?
No, tuned alerts are not permanently deleted. They are typically marked as resolved or hidden from the main active alert queue, but they remain in the system and can still be searched or reviewed during a security audit.
