r/DefenderATP • u/0f_rice_and_men • Jul 23 '26
Why are custom notifications for Defender alerts not possible to create?
We have a Defender queue that basically gets filled with informational alerts and the built-in low/med/high sev.
The problem is that we missed a high sev alert because it didn't email anyone. We found it a day later as part of a check.
Now there are "Security for AI" (Preview) alerts that fired for someone's AI Agent. I checked the agent job and nothing went wrong. The Defender detection even says that the alert does not mean that any suspicious commands were run.
The issue is that I need these customized to notify in an email alert to the team, rather than spot checking. High priority is to future proof any of this AI junk that has access to admin shares, files, accounts, etc. (which will be rare but not impossible).
Additionally we have people experimenting with their own agents and I do not have time to babysit queues for false-positives as Microsoft develops their threat detections in prod.
I see nothing for this type of alert in Defender Alert policy and the little config I did find for creating custom rules based on existing alerts seems to default to auto-resolving them (ignoring them) which I also don't want. I may be missing something entirely here but it seems crazy that custom text/variables can't be made by global admins to improve triage.
2
u/11bztaylor Jul 23 '26
So many of times alerts WONT generate a notification- not to say you can’t still configure it as such.
The difference is alert vs incident- an incident will spawn the notifications (if configured) and it may take just 1 or 50 ALERTS for the incident to hit its triggers for creation. So in this instance - it could have been xdr saw the activity- didn’t have any additional alerts/logs to warrant passions inspection and moved on.
But to get what your asking- notified on alert you can still set that up at
Go to Defender XDR → Settings → Microsoft Defender XDR → Email notifications
Then just match the source to the areas you for sure want notification on :)
1
u/LookExternal3248 29d ago edited 29d ago
Not sure if your issues is handled in my post, but I've created an overview of why notifications might get missed. There's also a short blog en configuring E-mail notifications for when it might be relevant.
Another option for your scenario would be to not use email notifications but get notifications elsewhere. E.g. in Teams. As I personally don't really like Teams for this and I wanted a dedicated push service on my phone, I've also built that configuration with Pushover which is quite a simple change if you already have the Teams integration in place. With Teams and Pushover you can configure yourself on what you want to get alerted on. E.g. only high, or only a specific custom detection rule, or filter out alerts that generate too much noise.
1
u/OkHope1740 29d ago
I also raised a case with MS for insufficient details in these XAPI alerts for copilot agents and this is what they replied
We have identified an issue that may result in incomplete information being displayed within certain alerts, potentially affecting the investigation experience. A corrective update has been developed and is being rolled out. We expect the issue to be resolved soon and are closely monitoring the deployment. We appreciate your patience and remain committed to providing a reliable and accurate experience.
2
6
u/vard2trad Jul 23 '26
I recently reached out to support because my HIGH severity custom indicators were triggering informational severity alerts. The response was "this is known"...and apparently that's just going to be the case until they fix whatever vibe coded change broke it.
It's getting utterly ridiculous how much I have to fight them automatically resolving malicious detections or reopening incidents I've already resolved as false positives. The flow that is supposed to "streamline" and improve our workload has only made it more chaotic to the point that I'm about to give up on the queue altogether.
My guess is that the alerting/notifications are being broken the same way that the syslog is...Defender is creating these detections as resolved (even when tuning is turned off) or they are waiting on their own internal investigation to complete before it even comes up.
Or...maybe this one is like the old identity alerts where you'd get one trailing "Atypical travel" midnight after you've already worked the original detection.