Missing incident description on Microsoft Defender XDR incidents created by Microsoft Sentinel

[ep3p]

Is your feature request related to a problem? Please describe.
Microsoft Defender XDR incidents have NEVER had a description field available in Microsoft Sentinel portal.

When "Incident provider name" is "Azure Sentinel" the incidents HAVE a description.

When "Incident provider name" is "Microsoft Defender XDR" the incidents do NOT have a description (in Microsoft Sentinel portal in Azure).

IF you integrate a Sentinel workspace to Microsoft Defender XDR , ALL the incidents will have now "Microsoft Defender XDR" as "Incident provider name", and ALL the incidents created by Microsoft Sentinel Analytics rules will LOSE their description (in Microsoft Sentinel portal in Azure).

There might be previous playbooks (logic apps) that USED the description field that now is empty, for incidents created by Microsoft Sentinel, and these playbooks now will continuously FAIL.

This is NOT expected, and is not mentioned in Microsoft Docs (https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration).

Describe the solution you'd like
Microsoft Defender XDR incidents SHOULD have a description in Microsoft Sentinel portal in Azure. They should not have missing attributes compared to incidents created directly by Microsoft Sentinel.

You should NOT LOSE capabilities when integrating Microsoft Sentinel with Microsoft Defender XDR.

[v-rusraut]

Hi @ep3p
Thanks for flagging this issue, we will investigate this issue and get back to you with some updates by 15 May 2024. Thanks!

[v-rusraut]

Hi @ep3p,
We are working with respective team, we will update you.
Thanks

[v-rusraut]

Hi @ep3p,
We are waiting for response from respective team, we will update you.
Thanks

[v-rusraut]

Hi @ep3p, Hope you're doing good. As you have raised the support case for this same issue, our support team is working on your ticket. ICM is raised for this issue and so this is duplicate issue that's why closing this issue.
Thanks

[ep3p]

@v-rusraut what do you mean?? I have not raised any support case. I have only opened this issue on this GitHub repository.

[v-rusraut]

Hi @ep3p,
Actually, our support team shared this issue with us and forwarded this ticket with respective team to work on this, so as other respective was working on this issue so we have closed this issue. but as you mentioned you did not raise any support case let us check with support team and verify once.

[v-rusraut]

Hi @ep3p,
We have received the response from respective concern team, The description feature is currently in a private preview as (Enhanced Sync for XDR). so due to that currently it's not visible in incident tab.

Thanks!

[ep3p]

Thank you very much @v-rusraut, understood.