Using Defender XDR alert tuning rules to hide or resolve alerts and reduce alert fatigue

SC-200 By islever Editorial Last updated

Respond to alerts and incidents in Microsoft Defender XDR

Short answer

BC Defender XDR alert tuning rules can only hide and resolve alerts to reduce noise; they cannot delete, merge, or assign.

Question

You have a Microsoft 365 subscription that uses Microsoft Defender XDR. You discover that when Microsoft Defender for Endpoint generates alerts for a commonly used executable file, it causes alert fatigue. You need to tune the alerts. Which two actions can an alert tuning rule perform for the alerts? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
  1. delete
  2. hide Correct Answer
  3. resolve Correct Answer
  4. merge
  5. assign

Key Takeaways

Defender XDR alert tuning rules support only two actions — hide and resolve — to reduce noise, so those are the two correct choices; delete, merge, and assign are not tuning actions.

To tune alerts from a commonly used executable that causes alert fatigue in Defender XDR, an alert tuning rule can hide the alerts (remove them from the queue but keep them logged) or resolve them automatically; it cannot delete, merge, or assign.

Common mistake: Picking merge or delete — alert tuning cannot merge alerts or delete them; it can only hide or resolve, so those selections are invalid for a tuning rule.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender XDR alert tuning rules are designed to reduce alert fatigue and support two actions: hide (keep the alert out of the incident queue while still logging it) and resolve (automatically mark the alert as resolved). These are the only two actions a tuning rule can perform.

Why the Other Options Are Wrong

Delete (A), merge (D), and assign (E) are not actions available to alert tuning rules. Merge, for example, is handled by incident correlation, not by an alert tuning rule.

Community Comment Notes

The community is unanimous (BC 100 votes). landfils describes both hide and resolve precisely, and RoombaDoinZoomba cites the Defender XDR alert settings documentation confirming tuning can only hide and resolve alerts.

Official Reference

https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts

This link opens the official vendor documentation in a new tab.

Community Votes

BC
100%

100% of anonymous learners picked answer BC. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. landfils 👍 3
    B and C Hide : This action allows you to hide alerts generated by the specified executable file, reducing the noise and alert fatigue. These hidden alerts will not appear in the incident queue but will still be logged for historical purposes. Resolve : This action automatically resolves alerts generated by the specified executable file. The alerts are marked as resolved, indicating that no further action is required. This helps in managing alert fatigue by automatically handling known benign alerts.
  2. tryade 👍 2
    Incorrect, B and C https://techcommunity.microsoft.com/blog/microsoftthreatprotectionblog/boost-your-detection-and-response-workflows-with-alert-tuning/3824712
  3. RoombaDoinZoomba 👍 1
    Incorrect: https://learn.microsoft.com/en-us/defender-xdr/investigate-alerts?tabs=settings Alert tuning can only hide and resolve alerts to assist, it cannot merge alerts.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide