KQL Search

This query is part of an Azure Logic App workflow designed to automatically manage Microsoft Defender incidents. Here's a simplified explanation of what it does:

1. Trigger: The workflow is set to run every 5 minutes.

2. Fetch Incidents: It retrieves all active security incidents from Microsoft Defender using the Microsoft Graph API.

3. Exclude Certain Incidents: It initializes a list of keywords (e.g., "Anomalous Token usage", "demo", "false positive") to exclude certain incidents based on their titles.

4. Filter Incidents: For each incident, it checks if the title contains any of the excluded keywords. If it does, the incident is ignored.

5. Check Priority Score: For incidents not excluded by title, it checks if the priority score is below 25.

6. Close Low-Priority Incidents: If an incident's priority score is below 25, it automatically closes the incident by updating its status to "resolved" and adds a comment indicating it was auto-closed due to a low priority score. It also tags the incident with "LowPrioScore" for traceability.

This process helps reduce noise and alert fatigue in a Security Operations Center (SOC) by automatically closing low-priority incidents, allowing analysts to focus on more critical issues.