An analyst complains that two related signals from the same attack, one from Microsoft Defender for Endpoint and one from Microsoft Defender for Identity, were tracked as separate cases, slowing the response. You want to understand how Microsoft Defender XDR is designed to reduce this fragmentation by default. Which built-in behaviour groups related alerts from different workloads into a single case for investigation?
- AAlert suppression, which detects that two alerts describe the same activity and hides the duplicate so that only one alert remains visible for the analyst to triage.
- BAutomated investigation and response, which runs playbooks on each alert and links the alerts together once its remediation actions on the affected assets complete successfully.
- CAlert correlation, which automatically aggregates related alerts and their affected assets across the Defender workloads into a single incident that represents the end-to-end attack. Correct
- DA Microsoft Sentinel Fusion rule, which uses machine learning to combine low fidelity signals from multiple products into a single high confidence multistage incident in the workspace.
Why A is wrong: Suppression hides or resolves alerts you have judged benign or redundant; it removes noise rather than uniting related alerts into a shared case, so it does not join the endpoint and identity signals into one incident.
Why B is wrong: Automated investigation and response inspects entities and remediates threats after an alert fires, but it does not perform the cross-workload aggregation that places multiple alerts into one incident, so it is not the grouping mechanism here.
Why C is correct: Microsoft Defender XDR correlates alerts and entities across Defender for Endpoint, Identity, Office 365, and Cloud Apps into one incident, so signals from different workloads that belong to the same attack are investigated together rather than separately.
Why D is wrong: Fusion correlates signals inside Microsoft Sentinel, not within the Defender XDR portal, and the scenario asks about the native XDR behaviour that already merged these workload alerts before any Sentinel rule was involved.