will Incidents syncing delay after we configure unified platform?

supriya nelluri 5

Hello team,

We are planning to enable sentinel workspace in defender XDR portal to get the unified portal experience. I have question, will there be a delay between the syncing of incidents from defender to sentinel after this change? I have searched but didn't got the right information from Microsoft docs(some documents saying that there will be 10 mins delay but that is also not clearly said). If possible please provide the documentation as well.

Thank you.

Sravanthi 0 Reputation points

2024-12-09T14:40:24.0966667+00:00

Even i have the same question, can anybody provide the details on this?
Sándor Tőkési 171 Reputation points

2024-12-09T18:51:47.1666667+00:00

I don't have an official MS document on this, but there is indeed a delay for Sentinel incidents.

When Sentinel is not connected to the Unified Portal, incidents are created directly in Sentinel when a rule triggers - almost immediate.
After connecting Sentinel, the rule trigger will create the incident in the Unified Portal (somewhat delayed), which will then be synced back to Sentinel (more delayed).

Based on my experience, this delay is usually less than 10 minutes though.

1 answer

Givary-MSFT 34,521 Reputation points Microsoft Employee

2024-12-16T05:32:47.2933333+00:00

@supriya nelluri Thank you for reaching out to us, As I understand you wanted to know whether is any delay in M365 Defender incidents to appear in Sentinel.

As per our documentation It can take up to 10 minutes from the time an incident is generated in Defender XDR to the time it appears in Microsoft Sentinel.

Let me know if have any further questions, feel free to post back.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
Please sign in to rate this answer.
supriya nelluri 5 Reputation points

2024-12-17T08:54:24.3+00:00

In the document you have given is not specifically mentioning after enabling the sentinel in defender portal. As of now in my environment, i have XDR connector enabled in sentinel and the incidents are coming from defender with out any delay. After enabling the sentinel in defender portal will that be the same case or will there be a delay? and is there is any cost involved with this integration?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

will Incidents syncing delay after we configure unified platform?

1 answer

Your answer