Overview
When configuring a Microsoft Defender incident profile in Security Incident Response (SIR) to ingest incidents into the platform, the profile exposes a Pull Closed Incidents option. This is a binary control: it either includes or excludes incidents that Microsoft Defender considers closed. In Defender, an incident is treated as closed when its status is Resolved.
A common requirement is more nuanced: teams want to ingest closed incidents, but only a specific subset of them (for example, only those of a certain category, alert title, or severity). The Pull Closed Incidents toggle alone cannot express that kind of conditional logic. This article shows how to achieve granular control using the profile's Filter Conditions.
How It Works
The Defender incident profile supports encoded filter conditions applied against the staging/import table for ingestion. When Use filter conditions is enabled, the profile evaluates each incoming record against your encoded query before creating a Security Incident. This gives you far more flexibility than the single toggle, because you can combine field-level conditions and OR groups.
The status field on the import records reflects the Defender state, so resolved represents a closed incident. You can therefore:
- Keep your standard clauses to bring in open incidents (i.e.,
status is not resolved) under whatever severity or category rules you need. - Add a separate OR clause (an
NQsegment in the encoded query) that admits resolved incidents only when they also match your restricted condition.
